&EPA
   United States
   Environmental Protection
   Agency
Response Protocol Toolbox:
Planning for and Responding to
Drinking Water Contamination
Threats and Incidents
Interim Final - August 2004
Response Guidelines

-------
           Response Protocol Toolbox:
           Planning for and Responding to
Drinking Water Contamination Threats and Incidents


              Response Guidelines

                 Interim Final - August 2004
                PLANNING AND PREPARATION
                      Threat Warning
                   Initial Threat Evaluation
                   Immediate Operational
                     Response Actions
                  Site Characterization and
                        Sampling
                   Public Health Response
                        Actions
                     Sample Analysis
                       Is Incident
                       Confirmed?
                  Remediation and Recovery

-------
                                                              RESPONSE GUIDELINES
                                 TABLE OF CONTENTS

INTRODUCTION	3

1    COMMUNICATIONS AND NOTIFICATIONS	4

  1.1    INITIAL NOTIFICATIONS	4
  1.2    CONTACT LIST	5

2    THREAT EVALUATION	6

  2.1    THREAT EVALUATION PROCESS	6
  2.2    EVALUATING THREAT WARNINGS	7
  2.3    THREAT EVALUATION WORKSHEET	8
  2.4    SECURITY INCIDENT REPORT FORM	13
  2.5    WITNESS ACCOUNT REPORT FORM	16
  2.6    PHONE THREAT REPORT FORM	20
  2.7    WRITTEN THREAT REPORT FORM	23
  2.8    WATER QUALITY/CONSUMER COMPLAINT REPORT FORM	26
  2.9    PUBLIC HEALTH INFORMATION REPORT FORM	28

3    SITE CHARACTERIZATION AND SAMPLING	30

  3.1    SITE CHARACTERIZATION PROCESS	30
  3.2    EMERGENCY WATER SAMPLE COLLECTION KIT	31
  3.3    SAMPLE CONTAINERS	32
  3.4    SAMPLE COLLECTION GUIDELINES	34
     3.4.1    Safety Guidelines	34
     3.4.2    Sampling Procedures	34
     3.4.3    Sample Holding	55
     3.4.4    Sample Transport	55
  3.5    SITE CHARACTERIZATION PLAN TEMPLATE	36
  3.6    SITE CHARACTERIZATION REPORT FORM	40
  3.7    FIELD TESTING RESULTS FORM	45
  3.8    SAMPLE DOCUMENTATION FORM	46
  3.9    CHAIN OF CUSTODY FORM	47

4    SAMPLE ANALYSIS	48

  4.1    LABORATORY CONTACT LIST	48
  4.2    GENERAL APPROACH FOR ANALYSIS OF UNKNOWNS IN WATER	49
  4.3    GENERAL CLASSES OF CHEMICALS, ANALYTE GROUPS, AND EXAMPLE CONTAMINANTS	50
  4.4    GENERAL CLASSES OF PATHOGENS, SPECIFIC ORGANISMS, AND SELECT AGENT STATUS	50

5    RESPONSE ACTIONS	51

  5.1    DECISION TREE FOR CONTAINMENT OPTIONS	51
  5.2    DECISION TREE FOR PUBLIC NOTIFICATION	52
  5.3    CONTAMINANT CHARACTERIZATION AND TRANSPORT WORKSHEET	53
  5.4    PUBLIC HEALTH RESPONSE ACTION WORKSHEET	59

6    APPENDICES	63

  6.1    CRITICAL SYSTEM INFORMATION CHECKLIST	63
  6.2    INFORMATION RESOURCES	64
  6.3    THREAT MANAGEMENT MATRICES	65
     6.3.1    Security Breach	65
     6.3.2    Witness Account	67
     6.3.3    Direct Notification by Perpetrator	68
     6.3.4    Unusual Water Quality or Consumer Complaints	70
     6.3.5    Notification by Public Health	72
                                                                   Interim Final - August 2004

-------
                                                            RESPONSE GUIDELINES
Introduction

The EPA released the interim final Response Protocol Toolbox:  Planning for and Responding to
Drinking Water Contamination Threats and Incidents (the Response Protocol Toolbox) in winter
of 2003 and spring of 2004 to help the water sector effectively and appropriately plan for and
respond to contamination threats and incidents.  Since its release, EPA has received feedback and
suggestions from several sources concerning improvements in the Response Protocol Toolbox.
These Response Guidelines have been developed to provide an easy to use document for field
and crisis conditions. While the Response Protocol Toolbox provides detailed information, the
Response Guidelines are to be viewed as the application of the same principles during an actual
incident.

As  stated in the definition of Response Guidelines in Module 1, Section 4.3 of the Response
Protocol Toolbox, Response Guidelines are different from an Emergency Response Plan in that
they are essentially a "field guide" for responding to contamination threats and can be developed
in many different formats.

This document is intended to be an action oriented document to assist drinking water utilities,
laboratories, emergency responders, state drinking water programs, technical assistance
providers, and public health and law enforcement officials during the management of an ongoing
contamination threat or incident. The Response Guidelines are derived from the content of the
six  full modules of the Response Protocol Toolbox.

The Response Guidelines are not intended to replace the Response Protocol Toolbox and they do
not contain the detailed information contained within the six complete modules.  Finally, users
are  encouraged to adapt the Response Guidelines as necessary to meet their own needs and
objectives.
                                                                 Interim Final - August 2004

-------
                                                                                  RESPONSE GUIDELINES
1        Communications and  Notifications

1.1   Initial Notifications
     'Possible' stage evaluation by utility
           'Credible' stage evaluation by utility
               24/7 Call Center
                 xxx-xxx-xxxx
WUERM
xxx-xxx-xxxx (home)
xxx-xxx-xxxx (cell)
wuerm@xxx.xxx (text messenger)

formation Officer
rom water utility
xxx-xxx-xxxx

Utility Head
xxx-xxx-xxxx





Safety Officer
from water utility
xxx-xxx-xxxx

Utility Operations
Chief
                         xxx-xxx-xxxx
        WUERM
     xxx-xxx-xxxx (home)
      xxx-xxx-xxxx (cell)
wuerm@xxx.xxx (text messenger)
      'Credible' stage evaluation by unified command
                                                                    'Confirmed' stage evaluation by unified command
           Agency Representative from Utility (WUERM)
                     xxx-xxx-xxxx (home)
                     xxx-xxx-xxxx (cell)
                wuerm@xxx.xxx (text messenger)
Utility Plant Operator
xxx-xxx-xxxx
-

Laboratory PoC
xxx-xxx-xxxx
1
SCADACoordinaor
xxx-xxx-xxxx
Unit Operator
L

Section Heads
xxx-xxx-xxxx
1

           Agency Representative from Utility (WUERM)
                    xxx-xxx-xxxx (home)
                     xxx-xxx-xxxx (cell)
                wuerm@xxx.xxx {text messenger)
                                                                                 Technical Specialists
                                                                                    {Water Utility)
                                                                     Water Utility Emergency Operations Center (WUEOCM)
                                                                                  xxx-xxx-xxxx {home)
                                                                                   xxx-xxx-xxxx {cell)
                                                                              wuerm@xxx.xxx {text messenger)
Utility Plant Operator
xxx-xxx-xxxx
-


Laboratory PoC
xxx-xxx-xxxx
1
SCADA Coordinator
xxx-xxx-xxxx
Unit Operator
xxx-xxx-xxxx

L



Section Heads
xxx-xxx-xxxx

|_ Key Person ne
xxx-xxx-xxxx

Maintenance Head
xxx-xxx-xxxx

-



Key Personnel
xxx-xxx-xxxx
Public Works Interface
xxx-xxx-xxxx

                                                                                        Interim Final - August 2004

-------
                                                        RESPONSE GUIDELINES
1.2  Contact List
TO BE COMPLETED
Agency
Name
Location
Phone
E-mail
                                                            Interim Final - August 2004

-------
                                                                  RESPONSE GUIDELINES
2   Threat Evaluation

2.1   Threat Evaluation Process
                                                     NO-
                 Review existing information
                 Perform site characterization
                Review additional information
                                             Consider operational response
                          YES
                                                             Close investigation, return \
                                                              to normal operation, and   I
                                                               document the threat.   J
[
nple analysis



Consider public health response
                Review additional information
                      o results confirm
                      contamination?
YES
I
Revise operational and public
health response as necessary
I

YES
i
Revise sampling and
analysis plans and continue
threat evaluation

                    Develop remediation
                     and recovery plan
                                                                       Interim Final - August 2004

-------
                                                            RESPONSE GUIDELINES

2.2   Evaluating Threat Warnings

The first critical step in evaluating a contamination threat is recognition of a threat warning (i.e.,
an unusual situation that may have presented the opportunity for contamination of the drinking
water).  The utility will likely be in the best position to observe a threat warning and evaluate
whether or not the activity is suspicious (i.e., first decision point in the Threat Evaluation
process). This section briefly describes factors to consider when evaluating various types of
threat warnings.

The common types of threat warnings include:
   •   Security breaches: A security breach is an unauthorized intrusion into a secured facility
       that may be discovered through direct observation, an alarm trigger, or signs of intrusion
       (e.g., cut locks, open doors, cut fences). Security breaches may be the most common
       threat warnings, but in most cases are related to day-to-day operation and maintenance
       within the water system. Other security breaches may be due to criminal activity such as
       trespassing, vandalism, and theft rather than attempts to contaminate the water.
          o   Security Incident Report Form —> Section 2.4

   •   Witness account: A threat warning may come from an individual who directly witnesses
       suspicious activity, such as trespassing, breaking and entering, or some other form of
       tampering. The witness could be a utility employee, law enforcement officer, citizen, etc.
          o   Witness Account Report Form —> Section 2.5

   •   Direct notification by perpetrator: A threat may be made directly, verbally or in
       writing, to the water utility, the news media, law enforcement, or a government agency.
       Verbal threats made over the phone are historically the most common type of direct
       threats from perpetrators; however, there have also been written threats to  contaminate
       the drinking water supply.
          o   Phone Threat Report Form —> Section 2.6
          o   Written Threat Report Form —> Section 2.7

   •   Unusual water quality or consumer complaints: Unusual water quality results or an
       unexplained or unusually high incidence of consumer complaints may serve as a warning
       of potential contamination.  In order to evaluate this type of warning, it will be necessary
       to carefully track routinely monitored water quality data and/or consumer complaints
       such that significant deviations from an established baseline might be observed.
          oD Water Quality and Consumer Complaints Report Form —> Section 2.8

   •   Notification by public health agency: Notification from a public health agency
       regarding increased incidence of disease or death is another possible threat warning. A
       threat triggered by a public health notification is unique in that at least a segment of the
       population has presumably been exposed to a harmful substance. In this case, public
       health officials may launch an epidemiological investigation in an attempt to identify the
       source of the outbreak, during which the utility may be expected to play a support role.
          o   Public Health Information Report Form —> Section 2.9
                                                                 Interim Final - August 2004

-------
                                                              RESPONSE GUIDELINES


2.3   Threat Evaluation Worksheet

INSTRUCTIONS
The purpose of this worksheet is to help organize information about a contamination threat warning that
would be used during the Threat Evaluation Process.  The individual responsible for conducting the
Threat Evaluation (e.g., the WUERM) should complete this worksheet.  The worksheet is generic to
accommodate information from different types of threat warnings; thus,  there will likely be information that
is unavailable  or not immediately available. Other forms in the Appendices are provided to augment the
information in  this worksheet.
THREAT WARNING INFORMATION

    Date/Time threat warning discovered:

    Utility Name and Address:  	
    Name/Number of person who discovered threat warning:
    Type of threat warning:
       D  Security breach        D  Witness account            D  Phone threat
       D  Written threat          D  Unusual water quality        D  Consumer complaints
       D  Public health notification D  Other 	
    Identity of the contaminant:    D Known        D  Suspected     D Unknown
       If known or suspected, provide additional detail below

       D   Chemical             D  Biological                  D  Radiological

       Describe
    Time of contamination:         D Known        D  Estimated     D Unknown
       If known or estimated, provide additional detail below

       Date and time of contamination:  	

       Additional Information:  	
    Mode of contamination:        D Known        D Suspected     D Unknown
       If known or suspected, provide additional detail below

       Method of addition:     D  Single dose      D Overtime         D Other 	

       Amount of material:
       Additional Information:
                                                                   Interim Final - August 2004

-------
                                                            RESPONSE GUIDELINES
Site of contamination:          D Known        D Suspected
   If known or suspected, provide additional detail below

   Number of sites: 	
                               D Unknown
   Provide the following information for each site.

   Site #1
   Site Name: 	
   Type of facility
        D  Source water
        D  Ground storage tank
        D  Distribution main
        D  Other
   Address:
D  Treatment plant
D  Elevated storage tank
D  Hydrant
D   Pump station
D   Finished water reservoir
D   Service connection
   Additional Site Information:
   Site #2
   Site Name:
   Type of facility
        D  Source water
        D  Ground storage tank
        D  Distribution main
        D  Other  	
   Address:
D   Treatment plant
D   Elevated storage tank
D   Hydrant
D   Pump station
D   Finished water reservoir
D   Service connection
   Additional Site Information:
   Site #3
   Site Name:
   Type of facility
        D  Source water
        D  Ground storage tank
        D  Distribution main
        D  Other
   Address:
D   Treatment plant
D   Elevated storage tank
D   Hydrant
D   Pump station
D   Finished water reservoir
D   Service connection
   Additional Site Information:
                                                                 Interim Final - August 2004

-------
                                                              RESPONSE GUIDELINES

ADDITIONAL INFORMATION

     Has there been a breach of security at the suspected site?     D  Yes      D No
       If "Yes", review the completed 'Security Incident Report' (Section 2.4)

     Are there any witness accounts of the suspected incident?    D  Yes      D No
       If "Yes", review the completed Witness Account Report' (Section 2.5)

     Was the threat made verbally over the phone?                D  Yes      D No
       If "Yes", review the completed 'Phone Threat Report' (Section 2.6)

     Was a written threat received?                               D  Yes      D No
       If "Yes", review the completed 'Written Threat Report' (Section 2.7)

     Are there unusual water quality data or consumer complaints? D  Yes      D No
       If "Yes", review the completed 'Water Quality/Consumer Complaint Report' (Section 2.8)

     Are there unusual symptoms or disease in the population?    D  Yes      D No
       If "Yes", review the completed 'Public Health Report' (Section 2.9)

     Is a 'Site Characterization Report' available?    D Yes          D  No
       If "Yes", review the completed 'Site Characterization Report' (Section 3.4)

     Are results of sample analysis available?       D Yes          D  No
       If "Yes", review the analytical results report, including appropriate QA/QC data

     Is a 'Contaminant Identification Report' available?   D Yes      D No
       If "Yes", review the completed 'Sample Analysis Report' (Section 4.3)

     Is there relevant information available from external sources?  D  Yes D No
       Check all that apply

       D Local law enforcement  D  FBI                        D    DW primacy agency
       D Public health agency   D  Hospitals/911 call centers   D    US EPA/Water ISAC
       D Media reports          D  Homeland security alerts     D    Neighboring utilities
       D Other   	

       Point of Contact: 	
       Summary of key information from external sources (provide detail in attachments as necessary):
                                         10                        Interim Final - August 2004

-------
                                                                RESPONSE GUIDELINES
THREAT EVALUATION
     Has normal activity been investigated as the cause of the threat warning?     D Yes D  No
       Normal activities to consider
           D  Utility staff inspections                    D  Routine water quality sampling
           D  Construction or maintenance              D  Contractor activity
           D  Operational changes                     D  Water quality changes with a known cause
           D  Other 	

     Is the threat 'possible'?      D Yes       D No

       Summarize the basis for this determination:  	
       Response to a 'possible' threat:
         D None                         D  Site characterization
         D Increased monitoring/security    D  Other 	
               D Isolation/containment
     Is the threat'credible'?        D Yes       D No

       Summarize the basis for this determination:  	
       Response to a 'credible' threat:
         D Sample analysis           D Site characterization
         D Partial EOC activation      D Public notification
         D Other
          D  Isolation/containment
          D  Provide alternate water supply
     Has a contamination incident been confirmed?

       Summarize the basis for this determination:
D  Yes
D  No
       Response to a confirmed incident:
         D Sample analysis           D Site characterization
         D Full EOC activation        D Public notification
         D  Initiate remediation and recovery
         D  Other 	
          D  Isolation/containment
          D  Provide alternate water supply
                                           11
                Interim Final - August 2004

-------
                                                             RESPONSE GUIDELINES
    How do other organizations characterize the threat?
Organization
n Local Law
Enforcement
D FBI
D Public Health
Agency
D Drinking Water
Primacy Agency
D Other
D Other
Evaluation
EJ Possible
fj Credible
n Confirmed
EJ Possible
O Credible
n Confirmed
EJ Possible
fj Credible
n Confirmed
|_| Possible
O Credible
O Confirmed
O Possible
O Credible
O Confirmed
O Possible
O Credible
O Confirmed
Comment






SIGNOFF
  Name of person completing this form:

     Print name
     Signature
Phone Number
                    Date/Time:
                                        12
                     Interim Final - August 2004

-------
                                                               RESPONSE GUIDELINES


2.4   Security Incident Report Form


INSTRUCTIONS
The purpose of this form is to help organize information about a security incident, typically a security
breach, which may be related to a water contamination threat.  The individual who discovered the security
incident, such as a security supervisor, the WUERM, or another designated individual may complete this
form.  This form is intended to summarize information about a security breach that may be relevant to the
threat evaluation process.  This form should be completed for each location where a security incident was
discovered.
DISCOVERY OF SECURITY INCIDENT
     Date/Time security incident discovered:
     Name of person who discovered security incident:
     Mode of discovery:
       D Alarm (building)
       D Video surveillance
       D Suspect confession
       D Other
                     D Alarm (gate/fence)          D
                     D Utility staff discovery         D
                     D Law enforcement discovery
                             Alarm (access hatch)
                             Citizen discovery
     Did anyone observe the security incident as it occurred?
       If "Yes", complete the Witness Account Report' (Appendix 8.4)
                                                    D  Yes
                                      D  No
SITE DESCRIPTION
    Site Name:
    Type of facility
           D  Source water
           D  Ground storage tank
               Distribution main
               Other
D
D
    Address:
D  Treatment plant
D  Elevated storage tank
D  Hydrant
D  Pump station
D  Finished water reservoir
D  Service connection
    Additional Site Information:
BACKGROUND INFORMATION
     Have the following "normal activities" been investigated as potential causes of the security
     incident?
       D Alarms with known and harmless causes      D Utility staff inspections
       D Routine water quality sampling               D Construction or maintenance
       D Contractor activity                          D Other 	
                                          13
                                                        Interim Final - August 2004

-------
                                                                RESPONSE GUIDELINES

    Was this site recently visited prior to the security incident?       D  Yes       D No
       If "Yes," provide additional detail below

       Date and time of previous visit:  	
       Name of individual who visited the site:

       Additional Information:
     Has this location been the site of previous security incidents?    D  Yes       D No
       If "Yes," provide additional detail below

       Date and time of most recent security incident:  	

       Description of incident: 	
       What were the results of the threat evaluation for this incident?
            D  'Possible'               D   'Credible'                 D  'Confirmed'

     Have security incidents occurred at other locations recently?      D Yes       D No
       If "Yes", complete additional 'Security Incident Reports' (Appendix 8.3) for each site

       Name of 1st additional site:
       Name of 2nd additional site:
       Name of 3rd additional site:
SECURITY INCIDENT DETAILS

    Was there an alarm(s) associated with the security incident?   D Yes          D No
       If "Yes," provide additional detail below

       Are there sequential alarms (e.g., alarm on a gate and a hatch)?     D Yes        D No

       Date and time of alarm(s):  	

       Describe alarm(s):  	


    Is video surveillance available from the site of the security incident?    D Yes       D  No
       If "Yes," provide additional detail below

       Date and time of video surveillance: 	

       Describe surveillance:
                                           14                         Interim Final - August 2004

-------
                                                               RESPONSE GUIDELINES
     Unusual equipment found at the site and time of discovery of the security incident:
       D Discarded PPE (e.g., gloves, masks)         D Empty containers (e.g., bottles, drums)
       D Tools (e.g., wrenches, bolt cutters)           D Hardware (e.g., valves, pipe)
       D Lab equipment (e.g., beakers, tubing)         D Pumps or hoses
       D None                                    D Other
       Describe equipment:
     Unusual vehicles found at the site and time of discovery of the security incident:
       D Car/sedan                   D  SUV                    D Pickup truck
       D Flatbed truck                 D  Construction vehicle       D None
       D Other 	

       Describe vehicles (including make/model/year/color, license plate #,  and logos or markings):
    Signs of tampering at the site and time of discovery of the security incident:
       D Cut locks/fences                           D Open/damaged gates, doors, or windows
       D Open/damaged access hatches              D Missing/damaged equipment
       D Facility in disarray                          D None
       D Other
       Are there signs of sequential intrusion (e.g., locks removed from a gate and hatch)?
       Describe signs of tampering:
                D
                D
Yes
No
    Signs of hazard at the site and time of discovery of the security incident:
       D Unexplained or unusual odors               D Unexplained dead animals
       D Unexplained dead or stressed vegetation      D Unexplained liquids
       D Unexplained clouds or vapors               D None
       D Other 	

       Describe signs of hazard: 	
SIGNOFF
  Name of person responsible for documenting the security incident:

     Print name  	

     Signature   	
Date/Time:
                                          15
 Interim Final - August 2004

-------
                                                               RESPONSE GUIDELINES


2.5   Witness Account Report Form


INSTRUCTIONS
The purpose of this form is to document the observations of a witness to activities that might be
considered an incident warning.  The individual interviewing the witness, or potentially the witness, should
complete this form.  This may be the WUERM or an individual designated by incident command to
perform the interview. If law enforcement is conducting the interview (which may often be the case), then
this form may serve as a prompt for "utility relevant information" that should be pursued during the
interview.  This form is intended to consolidate the details of the witness account that may be relevant to
the threat evaluation process. This form should be completed for each witness that is interviewed.
BASIC INFORMATION
     Date/Time of interview:
     Name of person interviewing the witness:

     Witness contact information
        Full Name: 	
        Address:
        Day-time phone:
        Evening phone:
        E-mail address:
     Reason the witness was in the vicinity of the suspicious activity:
WITNESS ACCOUNT
     Date/Time of activity:

     Location of activity:
       Site Name: 	
       Type of facility
            D  Source water           D  Treatment plant           D  Pump station
            D  Ground storage tank     D  Elevated storage tank      D  Finished water reservoir
            D  Distribution main         D  Hydrant                  D  Service connection
            D  Other  	

       Address:
       Additional Site Information:
                                          16                         Interim Final - August 2004

-------
Type of activity
   D Trespassing
   D Theft
   D Other
D  Vandalism
D  Tampering
   Additional description of the activity
                                                           RESPONSE GUIDELINES
D  Breaking and entering
D  Surveillance
Description of suspects
   Were suspects present at the site?

   How many suspects were present?
              D Yes
D  No
   Describe each suspect's appearance:
Suspect #
1
2
3
4
5
6
Sex






Race






Hair color






Clothing






Voice






   Where any of the suspects wearing uniforms?
   If "Yes," describe the uniform(s): 	
                      D Yes
            D No
   Describe any other unusual characteristics of the suspects:
   Did any of the suspects notice the witness?
   If "Yes," how did they respond:  	
                     D Yes
        D No
Vehicles at the site
   Were vehicles present at the site?        D Yes

   Did the vehicles appear to belong to the suspects?

   How many vehicles were present? 	
                              D No

                              D Yes
           D  No
                                      17
                                     Interim Final - August 2004

-------
                                                           RESPONSE GUIDELINES
   Describe each vehicle:
Vehicle #
1
2
3
4
5
6
Type






Color






Make






Model






License plate






   Where there any logos or distinguishing markings on the vehicles?
   If "Yes," describe: 	
                                    D  Yes
                         D No
   Provide any additional detail about the vehicles and how they were used (if at all):
Equipment at the site
   Was any unusual equipment present at the site?

   D  Explosive or incendiary devices
   D  PPE (e.g., gloves, masks)
   D  Tools (e.g., wrenches, bolt cutters)
   D  Lab equipment (e.g., beakers, tubing)
   D  Other                   	
                        D Yes
             D No
               D Firearms
               D Containers (e.g., bottles, drums)
               D Hardware (e.g., valves, pipe, hoses)
               D Pumps and related equipment
   Describe the equipment and how it was being used by the suspects (if at all):
Unusual conditions at the site
   Were there any unusual conditions at the site?
   D  Explosions or fires
   D  Dead/stressed vegetation
   D  Other
D  Fogs or vapors
D  Dead animals
                        D Yes
             D No
D  Unusual odors
D  Unusual noises
   Describe the site conditions:
                                      18
                                Interim Final - August 2004

-------
                                                              RESPONSE GUIDELINES
    Additional observations
       Describe any additional details from the witness account:
SIGNOFF
  Name of interviewer:
     Print name  	
     Signature   	    Date/Time:
  Name of witness:
     Print name  	
     Signature   	    Date/Time:
                                         19                        Interim Final - August 2004

-------
                                                               RESPONSE GUIDELINES

2.6   Phone Threat Report Form


INSTRUCTIONS
This form is intended to be used by utility staff that regularly answer phone calls from the public (e.g., call
center operators). The purpose of this form is to help these staff capturer as much information from a
threatening phone call while the caller is on the line. It is important that the operator keep the caller on
the line as long as possible in order to collect additional information. Since this form will be used during
the call, it is important that operators become familiar with the content of the form. The sections of the
form are organized with the information that should be collected during the call at the front of the form
(i.e., Basic Call Information and Details of Threat) and information that can be completed immediately
following the call at the end of the form (i.e., the description of the caller).  The information collected on
this form will be critical to the threat evaluation process.

Remember,  tampering with a drinking water system is a crime under the SDWA Amendments!

THREAT NOTIFICATION
    Name of person receiving the call: 	
     Date phone call received:

     Time phone call ended: _
    Originating number:
         Time phone call received:

         Duration of phone call: 	
         Originating name:
       w      w         ^^^^^^^^^^^^^^_^^^^^^^^^^^^^^_            w      w       ^^^^^^^^^^^^^^_^^^^^^^^^^^^^^_
        If the number/name is not displayed on the caller ID, press *57 (or call trace) at the end of the
        call and inform law enforcement that the phone company may have trace information.
     Is the connection clear?
D  Yes
    Could call be from a wireless phone?     D Yes

DETAILS OF THREAT
    Has the water already been contaminated?

    Date and time of contaminant introduction known?
       Date and time if known: 	
        D  No

        D  No


D  Yes

     D Yes
                            D No
                                  D  No
     Location of contaminant introduction known?
       Site Name: 	
               D Yes
                        D  No
       Type of facility
            D  Source water           D  Treatment plant
            D  Ground storage tank     D  Elevated storage tank
            D  Distribution main         D  Hydrant
            D  Other
                       D   Pump station
                       D   Finished water reservoir
                       D   Service connection
       Address:
       Additional Site Information:
                                          20
                        Interim Final - August 2004

-------
    Name or type of contaminant known?
       Type of contaminant
           D  Chemical               D  Biological

       Specific contaminant name/description: 	
                         RESPONSE GUIDELINES


                    D Yes             D No

                            D   Radiological
    Mode of contaminant introduction known?
       Method of addition:     D Single dose

       Amount of material:         	
                    D Yes             D No
          D Overtime        D  Other
       Additional Information:
    Motive for contamination known?

            D  Retaliation/revenge
            D  Other
          D Yes
D  Political cause
       Describe motivation:
D  No

    D  Religious doctrine
CALLER INFORMATION
    Basic Information:
       Stated name:  	
       Affiliation: 	
       Phone number: _
       Location/address:
    Caller's Voice:
       Did the voice sound disguised or altered?       D Yes

       Did the call sound like a recording?             D Yes

       Did the voice sound?       D Male  / D Female
       Did the voice sound familiar?
          If 'Yes,' who did it sound like?

       Did the caller have an accent?
          If 'Yes,' what nationality? 	
       How did the caller sound or speak?
          D  Educated
          D  Irrational
          D  Reading a script
            D Yes
            D Yes
    D Well spoken
    D Obscene
    D Other
         D  No

         D  No

    D Young / D Old

         D  No
         D  No
    D Illiterate
    D Incoherent
                                         21
                              Interim Final - August 2004

-------
                                                                 RESPONSE GUIDELINES

       What was the caller's tone of voice?
          D Calm                D  Angry           D  Lisping          D  Stuttering/broken
          D Excited              D  Nervous         D  Sincere          D  Insincere
          D Slow                D  Rapid           D  Normal          D  Slurred
          D Soft                D  Loud            D  Nasal           D  Clearing throat
          D Laughing            D  Crying           D  Clear           D  Deep breathing
          D Deep                D  High             D  Raspy           D  Cracking
          D Other 	
       Were there background noises coming from the caller's end?
          D Silence
          D Voices                    describe    	
          D Children                   describe    	
          D Animals                   describe    	
          D Factory sounds            describe    	
          D Office sounds              describe    	
          D Music                     describe    	
          D Traffic/street sounds        describe    	
          D Airplanes                  describe    	
          D Trains                     describe    	
          D Ships or large boats        describe    	
          D Other:
SIGNOFF
  Name of call recipient:

      Print name  	
      Signature   	   Date/Time:
  Name of person completing form (if different from call recipient):

      Print name  	
      Signature   	   Date/Time:
                                           22                         Interim Final - August 2004

-------
                                                               RESPONSE GUIDELINES

2.7   Written Threat Report Form


INSTRUCTIONS
The purpose of this form is to summarize significant information from a written threat received by a
drinking water utility.  This form should be completed by the WUERM or an individual designated by
incident command to evaluate the written threat. The summary information provided in this form is
intended to support the threat evaluation process; however, the completed form is not a substitute for the
complete written threat, which may contain additional, significant details.

The written threat itself (e.g., the note, letter, e-mail message, etc.) may be considered evidence and thus
should be minimally handled (or not handled at all) and placed into a clean plastic bag to preserve any
forensic evidence.

Remember,  tampering with a drinking water system is a crime under the SDWA Amendments!


SAFETY
A suspicious letter or package could pose a threat in and of itself, so caution should be exercised if such
packages are received.  The US Postal Service has issued guidance when dealing with suspicious
packages (http://www.usps.com/news/2001/press/pr01  1022qsa.htm).


THREAT NOTIFICATION
     Name of person receiving the written threat: 	
     Person(s) to whom threat was addressed:  	

     Date threat received:                            Time threat received:
     How was the written threat received?
          D  US Postal service               D Delivery service        D Courier
          D  Fax                           D E-mail                D Hand delivered
          D  Other 	

       If mailed, is the return address listed?    D Yes       D  No
       If mailed, what is the date and location of the postmark?
       If delivered, what was the service used (list any tracking numbers)?
       If Faxed, what is the number of the sending fax?

       If E-mailed, what is the e-mail address of sender?
       If hand-delivered, who delivered the message?
                                          23                         Interim Final - August 2004

-------
                                                             RESPONSE GUIDELINES

DETAILS OF THREAT
    Has the water already been contaminated?         D Yes            D No

    Date and time of contaminant introduction known?       D Yes            D No
       Date and time if known:
    Location of contaminant introduction known?           D Yes            D No
       Site Name: 	

       Type of facility
           D Source water           D Treatment plant          D  Pump station
           D Ground storage tank     D Elevated storage tank     D  Finished water reservoir
           D Distribution main         D Hydrant                 D  Service connection
           D Other  	

       Address:  	
       Additional Site Information:
    Name or type of contaminant known?                   D Yes            D No
       Type of contaminant
           D   Chemical               D  Biological                D  Radiological

       Specific contaminant name/description: 	
    Mode of contaminant introduction known?              D Yes            D No
       Method of addition:     D Single dose      D Overtime        D Other 	
       Amount of material:
       Additional Information:
    Motive for contamination known?            D Yes        D  No

           D  Retaliation/revenge      D  Political cause            D  Religious doctrine
           D  Other  	

       Describe motivation: 	
NOTE CHARACTERISES
    Perpetrator Information:
         Stated name: 	
         Affiliation:
         Phone number: _
         Location/address:
                                        24                        Interim Final - August 2004

-------
                                                               RESPONSE GUIDELINES

     Condition of paper/envelop:
          D  Marked personal               D  Marked confidential    D  Properly addressed
          D  Neatly typed or written          D  Clean                D  Corrected or marked-up
          D  Crumpled or wadded up        D  Soiled/stained         D  Torn/tattered
          D  Other: 	
     How was the note prepared?
          D  Handwritten in print           D Handwritten in script          D Computer typed
          D  Machine typed                D Spliced (e.g., from other typed material)
          D  Other: 	

          If handwritten, does writing look familiar?         D Yes         D  No
     Language:
          D  Clear English                 D Poor English
          D  Another language: 	
          D  Mixed languages: 	
     Writing Style
          D  Educated                    D Proper grammar              D Logical
          D  Uneducated                  D Poor grammar/spelling        D Incoherent
          D  Use of slang                  D Obscene
          D  Other: 	

     Writing Tone
          D  Clear                        D Direct                       D Sincere
          D  Condescending               D Accusatory                  D Angry
          D  Agitated                     D Nervous                     D Irrational
          D  Other: 	
SIGNOFF
  Name of individual who received the threat:

      Print name  	
     Signature   	    Date/Time:

  Name of person completing form (if different from written threat recipient):

     Print name  	

     Signature   	    Date/Time:
                                          25                        Interim Final - August 2004

-------
                                                              RESPONSE GUIDELINES

2.8   Water Quality/Consumer Complaint Report Form


INSTRUCTIONS
This form is provided to guide the individual responsible for evaluating unusual water quality data or
consumer complaints.  It is designed to prompt the analyst to consider various factors or information
when evaluating the unusual data. The actual data used in this analysis should be compiled separately
and appended to this form. The form can be used to support the threat evaluation due to a threat warning
from unusual water quality or consumer complaints, or another type of threat warning in which water
quality data or consumer complaints are used to support the evaluation.

Note that in this form, water quality refers to both specific water quality parameters and the general
aesthetic characteristics of the water that might result in consumer complaints.

Threat warning is based on:     D Water quality       D  Consumer complaints        D  Other

What is  the water quality parameter or complaint under consideration?

Are unusual consumer complaints corroborated by unusual water quality data?

Is the unusual water quality indicative of a particular contaminant of concern? For example, is the
color, order, or taste associated with a particular contaminant?

Are consumers in the affected area experiencing any unusual health symptoms?

What is  'typical' for consumer complaints for the current season and water quality?
     Number of complaints.
     Nature of complaints.
     Clustering of complaints

What is  considered to be 'normal' water quality (i.e., what is the baseline water quality data or
level of  consumer complaints)?

What is  reliability of the method or instrumentation used for the water quality analysis?
     Are standards and reagents OK?
     Is  the method/instrument functioning properly?

Based on recent data, does the unusual water quality appear to be part of a gradual trend (i.e.,
occurring over several days or longer)?

Are the  unusual water quality observations sporadic over a wide area, or are they clustered in a
particular area?
     What is the  extent of the area? A pressure zone. A neighborhood. A city block. A street. A
     building.
                                         26                        Interim Final - August 2004

-------
                                                                RESPONSE GUIDELINES

If the unusual condition isolated to a specific area:
     Is this area being supplied by a particular plant or source water?
     Have there been any operational changes at the plant or in the affected area of the system?
     Has there been any flushing or distribution system maintenance in the affected area?
     Has there been any repair or construction in the area that could impact water quality?
SIGNOFF

  Name of person completing form:

      Print name
      Signature   	    Date/Time:
                                          27                         Interim Final - August 2004

-------
                                                              RESPONSE GUIDELINES

2.9   Public Health Information Report Form


INSTRUCTIONS
The purpose of this form is to summarize significant information about a public health episode that could
be linked to contaminated water. This form should be completed by the WUERM or an individual
designated by incident command. The information compiled in this form is intended to support the threat
evaluation process.

In the case of a threat warning due to a report from public health, it is likely that the public health agency
will assume incident command during the investigation. The drinking water utility will likely play a support
role during the investigation, specifically to help determine whether or not water might be the cause.

PUBLIC HEALTH  NOTIFICATION
     Date and Time of notification:  	             	
    Name of person who received the notification:
    Contact information for individual providing the notification
        Full Name: 	
        Title:
        Organization:
        Address:
        Day-time phone:
        Evening phone:
        Fax Number: 	
        E-mail address:
    Why is this person contacting the drinking water utility?
    Has the state or local public health agency been notified?     D  Yes         D  No
        If "No," the appropriate public health official should be immediately notified.
DESCRIPTION OF PUBLIC HEALTH EPISODE
    Nature of public health episode:
       D Unusual disease (mild)          D Unusual disease (severe)        D  Death
       D Other: 	
Symptoms:
D Diarrhea
D Fever
D Other:
D Vomiting/nausea
D Headache
D Flu-like symptoms
D Breathing difficulty
       Describe symptoms:
    Causative Agent:       D Known          D Suspected          D Unknown
       If known or suspected, provide additional detail below

       D  Chemical             D Biological                  D Radiological

       Describe 	


       Estimate of time between exposure and onset of symptoms: 	
                                         28                        Interim Final - August 2004

-------
                                                              RESPONSE GUIDELINES
    Exposed Individuals:
       Location where exposure is thought to have occurred
           D Residence                D  Work                       D School
           D Restaurant                D  Shopping mall               D Social gathering
           D Other:  	

           Additional notes on location of exposure: 	
          Collect addresses for specific locations where exposure is thought to have occurred.

       Is the pattern of exposure clustered in a specific area?      D  Yes        D  No

       Extent of area
          D Single building            D Complex (several buildings)   D City block
          D Neighborhood             D Cluster of neighborhoods      D Large section of city
          D Other: 	

          Additional notes on extent of area: 	
       Do the exposed individuals represent a disproportionate number of:
           D Immune compromised      D Elderly                     D Children
           D Infants                   D Pregnant women             D Women
           D Other:  	
           D None, no specific groups dominate the makeup of exposed individuals

EVALUATION OF LINK TO WATER
    Are the symptoms consistent with typical waterborne diseases, such as gastrointestinal
    disease, vomiting, or diarrhea?                                     D Yes        D No

    Does the area of exposure coincide with a specific area of the system, such as a pressure
    zone or area feed by a specific plant?                               D Yes        D No

    Were there any consumer complaints within the affected area?        D Yes        D No

    Were there any unusual water quality data within the affected area?    D Yes        D No

    Were there any process upsets or operational changes?               D Yes        D No

    Was there any construction/maintenance within the affected area?     D Yes        D No

    Were there any security incidents within the affected area?            D Yes        D No


SIGNOFF

  Name of person completing form:

     Print name
     Signature   	   Date/Time:
                                         29                        Interim Final - August 2004

-------
                                                           RESPONSE GUIDELINES
3   Site Characterization and Sampling

3.1  Site Characterization Process
Initial threat
evaluation

Threat is
'possible'







?OCESS
u_
Q.
Z
O
1-
D
UU
1-
THREA




/I -
V

  Place samples in
   secure storage
                        Customize the Site
                      Characterization Plan
                       Approaching the Site
                       Characterize the Site
                         Collect Sample
                         Exiting the Site
                       YES-
Ship samples to lab
                                                      Initial evaluation
                                                  Identify investigation site
                           Characterize site hazards
                                                 Develop sampling approach
                                                Form site characterization team
                                                Conduct field safety screening
                                                 Observe site conditions and
                                                  determine signs of hazard
                                                 Repeat field safety screening
                          Investigate site and evaluate
                                   hazards
                                                  Conduct field water testing
                                       30
                                         Interim Final - August 2004

-------
                                                      RESPONSE GUIDELINES
3.2  Emergency Water Sample Collection Kit
Item Quantity
Notes
Field Resources and Documentation
Field guide
Health and safety plan
Sample labels
Sample documentation forms
Custody tape (or seals)
Chain of custody forms
Lab marker
2
2
48
24
2 rolls
24
2
Resource for field personnel
If required for the site
Waterproof (filled out in advance, if possible)
For recording sample information
Used on sample or shipping containers
For documenting sample custody
Waterproof, 1 red, 1 black
General Sampling Supplies
Sample containers
Device for grab sampling
10 liter HDPE container
Lab grade tape
Miscellaneous glassware
Collapsible cooler
Rigid shipping container
1 qt. zippered freezer bags
Thermometer
Paper towels
Table 3-2
1
4
3 rolls
N/A
1
1
1 packlOO
2
2 rolls
For collecting samples
For sampling large water bodies
For collection of large volume water samples
For temporary labeling in the field
Beakers, graduated cylinders, spatula, etc.
For sample storage
For shipping by overnight service if needed.
For double bagging ice and sample containers
For checking water temperature
Wiping wet containers and containing spills
Pathogen Sampling Supplies
Tubing and clamp
Stopwatch & graduated cylinder
Ultrafiltration apparatus
1
1
1
For sample tap flushing, etc.
For measuring flow rate
For concentrating pathogen samples
Reagents (may need to be kept separate from the rest of the kit)
Laboratory grade water
Sodium thiosulfate crystals
Ascorbic acid
Sodium sulfite crystals
Potassium dihydrogen citrate
6 Molar ACS grade hydrochloric
acid (HC1)
6 Molar trace metal-grade nitric
acid (HNO3)
1 0 Normal Sodium hydroxide
(NaOH)
pH paper in ranges from 0-4 and
10- 14
5 liters
1 00 grams
1 00 grams
1 00 grams
1 00 grams
25 mL
25 mL
25 mL
50 strips
For sample dilution in the field
For water sample dechlorination
For water sample dechlorination
For water sample dechlorination
For carbamate preservation
In dropper bottle for preservation of samples for
organic analyses
In dropper bottle for preservation of samples for
trace metals analysis
In dropper bottle for preservation of samples for
cyanide analyses
For checking the pH of samples preserved with
acid or base (sensitive to 0.5 pH units)
Safety Supplies
Splash resistant goggles
Disposable gloves
Disposable shoe covers
Disposable laboratory coats
Clear, heavy duty plastic trash bags
Rinse water
Antiseptic wipes
Bleach solution (at least 5%)
Squirt bottle
First aid kit
Flashlight/headlamp
2
6 pairs
2 pairs
2
4
20 liters
1 container
1 gallon
2
1
3
One per individual (minimum)
Nitrile or polyethylene, powder- free
One pair per individual (minimum)
One per individual (minimum)
For disposal of lab coat, gloves, etc.
For general use and first aid
For cleaning hands, sample containers, etc.
For decontamination if necessary
For use with rinse water or lab grade water
For general first aid
For working at night or in dark locations
                                   31
Interim Final - August 2004

-------
C/5
Q
KH

O
O
OH
GO
W
Pi
        Q)
        .C
        C
        8
        Q.
        S
        
tf »^5
C ^3
II
^5 «
2§



Analytical
Technique


OJ
Preservati
M
e
v^
e
°c

S "e
3J M
Q •<

d
Z



Container
Type

u.
OJ
c ^
0 N
U as





OJ
a.
H1
«
"a.
|
as






















%
o>
'S
0>
H

•o
^11
V (Establish
F— 1
a

fij
u
as
(j
hH
as

pa

1
S-;
CHEMISTRY



































Kl
o>

^^
e
'S
u.
o

ci
Tl-'
(N

"^ ^o
wS



P&T - GC/MS

(N
V
ffi
o g
ffi S
T! u

'o
ca
o
13
^H
Q
O
<[^


ci
(N
O
in pQ
^-* CS
W §



P&T-
GC/PID/ELCD













in
S
o

1)
f-i _ca
> u
t> 01
01 rg
S u
^S o
O ^H




S
o
Tl-










rH
'o
•ri
m
•o
CO

Kg
in t^
CS CS
in oo



SPE GC/MS


S
O -a
^H +^
> w
> o a
t> S cd




h-l
7—1





01
rH
'o
1)
oo




CN
ON
Tl-
in



O
h-l
PH
ffi
w
PH
oo
(N
ffi
a
o
+j
T3
Sulfuric ac:


w
+j
S ^
pi 0
^3 O
o -a
oo -5

Tl-


o £
Amber PVC
silanized gla:




h-l
• — <





Quarternary
nitrogen
compounds




(N
^H
en
in

O
C
HPLC-fluoresce

1) OO
cd en
^ i
^-* f
•o o
Potassium
dihydrogen
sample pH


w
-M
S ^
pi 0
^3 O
o -a
oo -5

Tl-
s
o

1)
"~^ a
S 01
01 *rt
J 8
C1"} tS




h-i
o
Tl-





Carbamate
Pesticides


































VI
+1

£^
a
Inorganic An;




oo
o
o
CN



oo
PH
O
hH




t^ ON
O O
o o
(N (N



oo
W
is

u
03 u
&^
S'o 	 ;
ca ^3
III
£ -a a





u
o
^X",

(N



S"
Q
Is
c§ l)



h-l
S
in
(N




01
+" *
Metals/Elemel




^H (S|
in in




AA - cold vapoi
manual
AA - cold vapoi
automater
(N
VI
ffi
a
_o
2 °
.a s
iz oo





u
o
^X",

(N



Q
0 ^
to
rS ^



h-l
S
in
(N





o
Organometalli
compounds




(N
in
en
en
o
•c
-C
Titrimetric
Spectrophotome




en
in
en
en


^
Colorimetric U\
3
1) O
•§ "i
S S
'o u
3 CN
0 ffi

'o

o
IS
Q
o
01
<[^

(N



o
1




h-l
' — '





1)
o"

M
•rH
£^
oo
o
o
ON

Ol
01 ri
Gross alpha, gro
beta, gamma
isotopes, specifii
radionuclides
rH
ra
1
^^
1 &
S 8
S^
ll





u
o
^X",

(N



o
01




h-l
(N





O
'5b
'o
                                                                                                                                             O
                                                                                                                                             O
                                                                                                                                             (N
                                                                                                                                             1
                                                                                                                                             (N
                                                                                                                                             en

-------
GO
«

5

w
Q


B
w
GO

§
OH
GO
«
Pi

Reference
Methods

Analytical
Technique






Preservative

e
•-B
a

^
a |
Q 
e
3
e oj
0 N
U X



Sample Type















^-^

9
e
^
H

u.
o
•-.
o
a.
rVl

CREEN
cc
Q
a
Q
Z

.S"
^
H
;»•>
o

^
_o
"a.
a



•8
^
is
-S
td

CREEN
cc
Q
a
Q
Z
>
Rapid toxicity asss
(several vendors)





O3
Consult
manufacturer
instructions.

03
13
b fH
^ t3 .2
^S tj
§ § F?
6 a .s



(N






O

h-l
(N


'o
'x
O
H
o
o
(N
 I

13
 OJ

-------
                                                             RESPONSE GUIDELINES
3.4   Sample Collection Guidelines

3.4.1  Safety Guidelines
    1.  Do not enter the site to perform sampling until cleared. Hazardous materials response
       units may perform safety screening before allowing other responders to enter the site.
       Note that field safety screening does not generally include testing for pathogens.
    2.  Do not eat, drink, or smoke at the site.
    3.  Do not taste or smell the water samples.
    4.  Do use general personal protective equipment (PPE) such as splash-proof goggles,
       disposable gloves, proper footwear (i.e., no open toe or open heel shoes), a chemical
       resistant, disposable lab coat, and long pants. (Note that this level of PPE is only
       intended to minimize incidental contact with the water or chemical reagents used during
       sample collection or field testing.)
    5.  Avoid all skin contact with the water, and if incidental contact does occur, immediately
       flush the affected  area with clean water brought to the site for  that purpose.
    6.  Fill sampling  containers slowly to avoid volatilization or aerosolization of contaminants.
    7.  Minimize the time that personnel are on the site and collecting samples.
3.4.2  Sampling Procedures
    1.  Pre-label sample containers with a waterproof marker. Information should include:
       analyte class (pathogen, chemical, or radionuclide), specific analyte (if sample is being
       collected for a specific target), sample identification number, utility name, location of
       sample collection, sample collection date and time, and sampler's initials.
    2.  Check for the presence of any in-line filters (e.g., home treatment devices) that might
       interfere with sampling.  Remove such devices if present.
    3.  If the sample tap is the suspected point of contaminant introduction, collect swab samples
       from the tap before flushing the tap and collecting water samples.
    4.  Flush sample taps for a time sufficient to displace the water in connecting lines in order
       to obtain a sample that is representative of the water of interest.  Keep the flow rate from
       the sample tap sufficiently low  in order to avoid splashing and aerosolizing water
       droplets.  Divert water to a drain if possible.
    5.  Carefully collect samples in the specified containers (see Section 3.3).  If a reagent needs
       to be added to the sample, allow enough headspace in the container to add the proper
       amount of preservative. Cap then gently mix the contents to ensure that the reagent is
       properly mixed with the sample. Test the sample with a strip of pH paper to ensure
       preservation to the proper pH. Do not insert the pH paper into the sample container.
       Pour a small portion of the mixed sample into the container cap then pour from the cap
       onto the pH paper to verify
    6.  For chlorinated samples, VOCs should be collected into a secondary 8-oz. glass container
       (prepared with ascorbic acid - see footnote 1, Table 3.3). Gently mix the sample and
       transfer to 3, 40-ml VOA containers (triplicate). Fill the 40-ml container above the top to
       form a meniscus.  Close the container with the Teflon side of the septa facing the water
       sample, gently invert the sample container several times, and verify that there are no air
       bubbles in the container. Once each container is tagged, the three 40-ml containers
                                        34                       Interim Final - August 2004

-------
                                                            RESPONSE GUIDELINES
       should be inserted into a plastic whirlpack bag (provided) and sealed prior to sample
       storage.
   7.  Wipe the outside of the sealed containers with paper towel.
   8.  Attach custody seal to the sample container.
   9.  Place the sealed container into a rigid cooler and pack with frozen ice packs (preferred)
       or scalable freezer bags filled with ice.
   10. Tag each sample and record all necessary information on "Sample Documentation" and
       "Chain of Custody" forms.
   11. After all samples have been collected, preservative blanks and temperature blanks should
       be prepared and tagged. A preservative blank should be prepared for each preservative
       used during the sampling event.  The preservative blank can be prepared by adding the
       appropriate amount of preservative to the preservative blank containers, and tagging the
       sample for the appropriate analysis (i.e., HNO3 preservative blank should be analyzed for
       metals).  Additionally, a temperature blank container should be placed in each cooler
       containing samples.
3.4.3  Sample Holding
    1.  When samples are not in the possession of designated personnel, they should be secured
       (e.g., locked in a secure area) and only accessible by designated personnel. In the field,
       samples may need to be locked in a vehicle.
    2.  Samples should be chilled, but protected from freezing.
    3.  Samples should be held at the drinking water utility lab until shipped to a lab for analysis
       or until it is determined that they are not needed.
    4.  Samples that are held longer than the approved holding times for contaminant analysis
       may no longer be useful.


3.4.4  Sample Transport

    1.  Sample integrity and chain of custody must be maintained. All factors that might
       compromise sample integrity (e.g., storage containers, excessive transit time,
       temperature, pressure, physical disturbance, etc.) should be considered and appropriate
       measures taken to avoid compromising samples.
    2.  Sample packaging must be in compliance with shipping regulations.
    3.  Samples may be screened by law enforcement and/or ICs prior to sample transport to the
       laboratory.
    4.  Samples will be transported to the appropriate laboratory in coordination with law
       enforcement using appropriate air and ground assets.
                                        3 5                        Interim Final - August 2004

-------
                                                           RESPONSE GUIDELINES
 3.5  Site Characterization Plan Template
 INSTRUCTIONS
 This form is intended to support the development of a customized site characterization plan
 developed in response to a specific water contamination threat.  The incident commander and
 site characterization team leader should develop this plan jointly if possible. The completed
form will be used to guide site characterization activities in the field; however, it may be
 necessary to revise the initial plan based on initial observations at the site.  A form should be
 completed for each investigation site that will be characterized.

 THREAT WARNING INFORMATION
    Consult Module 2, Appendix 8.2 "Threat Evaluation Worksheet" for details about the
    threat.

 INVESTIGATION SITE
    Site Name: 	
     Type of facility:
       D Source water
       D Ground storage tank
          reservoir
       D Distribution main
       D Other      	
D Treatment plant
D Elevated storage tank

D Hydrant
D Pump station
D Finished water

D Service connection
     Address:
     Additional Site Information:
INITIAL HAZARD ASSESSMENT
     Are there any indicators of an explosive hazard?            D Yes
       If "Yes," notify law enforcement and do not send a team to the site.
                                       D  No
     Initial hazard categorization
       D Low hazard                            D Chemical hazard
       D Radiological hazard                    D Biological hazard
       If the initial hazard assessment indicates a chemical, radiological, or biological hazard
       (as described in Module 3, Section 4.1.3), then only teams trained to deal with such
       hazards should be sent to the site.
                                       36
                            Interim Final - August 2004

-------
                                                           RESPONSE GUIDELINES
SITE CHARACTERIZATION TEAM
    Name & Affiliation of Site Characterization Team Leader:
    Drinking water utility staff:
       D  Water quality specialist   Name:
       D  Security specialist        Name:
       D  Operations specialist      Name:
       D  Other	   Name:
    Representatives from other agencies:
       D   Local law enforcement     D  Fire department
       D   US EPA                  D  FBI
                           D  HazMat
                           D  Other
COMMUNICATION PROCEDURES
    Mode of communication:
       D  Phone
       D  Facsimile

    Reporting events:
       D  Upon arrival at site
       D  After site evaluation
       D  Other
D 2-way radio
D Other
D During approach
D After field testing
FIELD SCREENING CHECKLIST
D Digital
D Site entry
D Site exit
• •











Parameter
Radiation
Chlorine residual
pH / conductivity
Cyanide
Volatile
chemicals
Chemical
weapons
Biotoxins
Pathogens



Screen
Both
Water
Water
Water
Safety
Both
Water
Water



Meter/Kit ID3











Check Date4











Reference Value











    1. List the parameters that will be evaluated as part of field screening (examples are listed).
    2. Screening may be conducted for safety, rapid water testing, or both.
    3. Report the unique identifier for the meter or kit used during screening.
    4. Report date of last calibration, last equipment check, or expiration date as appropriate.
    5. List any reference value that would trigger a particular action, such as exiting the site.
                                       37
                            Interim Final - August 2004

-------
                                                            RESPONSE GUIDELINES
SAMPLING CHECKLIST
• •

















Analyte
Standard VOCs
Semi-volatiles
Quartenary nitrogen
compounds
Cyanide
Carbamate pesticides
Metals/elements
Organometallic compounds
Cyanide
Radionuclides
Non-target VOCs
Non-target organic
compounds
Non-target inorganic
compounds
Immunoassays
Pathogens - culture
Pathogens - PCR
Water quality - bacteria
Water quality - chemistry
No.
Samples

















Sample Preservation

















    1.  List the parameters that will be sampled during site characterization (examples are
        listed).
    2.  List preservatives and dechlorinating agents and indicate if they are to be added in the
        field.
EQUIPMENT CHECKLIST
    D Completed Site Characterization Plan
    D Emergency Water Sampling Kit (Table 3-1)
    D Reagents (if stored separately)
    D Laboratory grade water (5 gal)
    D Special equipment for the specific site
    D Other
D Additional documentation
D Field Testing Kit (Table 3-3)
D Bags of ice or freezer packs
D Rinse water (20 liters)
D Disposable camera
                                        38
                Interim Final - August 2004

-------
                                                           RESPONSE GUIDELINES


SAMPLE HANDLING INSTRUCTIONS
    Sample delivery:
       D  Return samples to water utility
       D  Ship samples to specified location
       D  Deliver samples to specified recipient (e.g., laboratory, law enforcement, shipping co.,
          etc.)

       Name of recipient: 	

       Phone No.:  	             Fax No.: 	

       Delivery address: 	
    Sample storage and security:
       Describe any special precautions or instructions related to sample storage and security:
SIGNOFF
  Incident Commander (or designee responsible for developing Site Characterization Plan):
     Print name 	
     Signature   	    Date/Time:  	
  Site Characterization Team Leader:
     Print name 	
     Signature   	    Date/Time:
                                       3 9                       Interim Final - August 2004

-------
                                                          RESPONSE GUIDELINES
3.6  Site Characterization Report Form

INSTRUCTIONS
Members of the site characterization team can use this form to record their observations at the
investigation site.  It also serves as a checklist for notifying incident command at key points
during the characterization.  Additional checklists are included in this form for sample collection
and exiting the site. The completed form can also be used as a component of the site
characterization report. A form should be completed for each investigation site that is
characterized

GENERAL INFORMATION
    Date: 	               Time arrived investigation at site:  	
    Name of Site Characterization Team Leader:
    Phone No.: 	              Fax No.:

LOCATION OF INVESTIGATION SITE
    Site Name: 	
    Type of facility:
       D Source water              D Treatment plant          D  Pump station
       D Finished water reservoir    D Elevated storage tank     D  Ground storage tank
       D Distribution main          D Hydrant                 D  Service connection
       D Other      	

    Address:    	
    Weather Conditions at Site:
    Additional Site Information:
                                      40                       Interim Final - August 2004

-------
                                                          RESPONSE GUIDELINES
APPROACH TO SITE
    Time of Approach to Site:
    Initial Field Safety Screening (as listed in the "Site Characterization Plan"):
       D  None                     D Radiation               D  Volatile chemicals
       D  HAZCAT                 D Chemical weapons       D  Biological agents
       D  Other      	

       Report results of field safety screening in Section 3.7 "Field Testing Results Form."
       If any field safety screening result is above the corresponding reference value,
       immediately notify incident command and do not proceed further into the site.

    Initial Observation and Assessment of Immediate Hazards
       D  Unauthorized individuals present at the site
       D  Fire or other obvious hazard
       D  Signs of a potential explosive hazard (e.g., devices with exposed wires)
       D  Signs of a potential chemical hazard (e.g., dead animals, unusual fogs, unusual odors)
       D  Unusual and unexplained equipment at the site
       D  Other signs of immediate hazard 	

       If there are any indicators of immediate hazard, immediately notify incident command
       and do not proceed further into the site.

    Report initial observations and results to incident commander.
       Approval granted to proceed further into the site?              D Yes   D No

SITE INVESTIGATION
    Time of Entry to Site:  	
    Repeat Field Safety Screening
       D  None                     D Radiation               D  Volatile chemicals
       D  HAZCAT                 D Chemical weapons       D  Biological agents
       D  Other      	

       Report results of field safety screening in Section 3.7 "Field Testing Results Form.'
       If any field safety screening result is above the corresponding reference value,
       immediately notify incident command and do not proceed further into the site.

    Signs of Hazard:
       D  None                                  D  Unexplained dead animals
       D  Unexplained dead or stressed vegetation   D  Unexplained clouds or vapors
       D  Unexplained liquids                     D  Other  	
       Describe signs of hazard:
                                       41                       Interim Final - August 2004

-------
                                                      RESPONSE GUIDELINES
Unexplained or Unusual Odors:
   D None
   D Sulfur
   D Sweet/Fruity
  Describe unusual odor:
D Pungent
D Skunky
D New mown hay
D Irritating
D Bitter almond
D Other 	
Unusual Vehicles Found at the Site:
   D Car/sedan                 D SUV
   D Flatbed truck              D Construction vehicle
   D Other 	
                           D  Pickup truck
                           D  None
  Describe vehicles (including make/model/year/color, license plate #, and logos or
  markings): 	
Signs of Tampering:
   D  None
   D  Open/damaged gates, doors, or windows
   D  Missing/damaged equipment
   D  Other 	
              D  Cut locks/fences
              D  Open/damaged access hatches
              D  Facility in disarray
   Signs of sequential intrusion (e.g., locks removed from a gate and hatch)?
   D Yes                                                 D  No
  Describe signs of tampering:
Unusual Equipment:
   D None
   D Tools (e.g., wrenches, bolt cutters)
   D Lab equipment (e.g., beakers, tubing)
   D Other                	
              D  Discarded PPE (e.g., gloves, masks)
              D  Hardware (e.g., valves, pipe)
              D  Pumping equipment
  Describe equipment:
                                  42
                             Interim Final - August 2004

-------
                                                          RESPONSE GUIDELINES
    Unusual Containers:
      Type of container:
         D None
         D Plastic bag
         D Test Tube
      Condition of container:
         D Opened
         D Unopened

      Size of container:  	
D Drum/Barrel
D Box/Bin
D Bulk container
D New
D Old
      Describe labeling on container:
 D  Bottle/Jar
 D  Pressurized cylinder
 D  Other
 D  Damaged/leaking
 D  Intact/dry
      Describe visible contents of container:
    Rapid Field Testing of the Water
       D  None                     D
       D  Cyanide                  D
       D  Pesticides                 D
       D  Other      	
 Residual disinfectant
 Radiation
 Biotoxins
D pH / conductivity
D VOCsandSVOCs
D General toxicity
      Report results of rapid field testing of the water in Section 3.7 "Field Testing Results
      Form."
      If any field test result is above the corresponding reference value, immediately notify
      incident command and wait for instruction regarding how to proceed.
    Report findings of site investigation to incident commander.
      Approval granted to proceed with sample collection?

SAMPLING
    Time Sampling was Initiated / Completed: 	/.
                              D Yes    D  No
    Implement Sampling Procedures Appropriate for the Hazard Conditions at the Site:
       D Low hazard                           D Chemical hazard
       D Radiological hazard                    D Biological hazard
    If the site is characterized as a chemical, radiological, or biological hazard, then special
    sampling and safety procedures should be followed.
                                      43
                          Interim Final - August 2004

-------
                                                            RESPONSE GUIDELINES
    Safety Checklist:
       D  Do not eat, drink, or smoke at the site.
       D  Do not taste or smell the water samples.
       D  Do use the general PPE included in the emergency water sampling kit.
       D  Avoid all contact with the water, and flush immediately with clean water in the case
          of contact.
       D  Slowly fill sample bottles to avoid volatilization and aerosolization.
       D  Minimize the time that personnel are on site and collecting samples.

    General Sampling Guidelines:
       D  Properly label each sample bottle.
       D  Carefully flush sample taps prior to sample collection, if applicable.
       D  Collect samples according to method requirements (e.g., w/o headspace for VOCs).
       D  Add preservatives or dechlorinating agents as specified.
       D  Carefully close sample containers and verify that they don't leak.
       D  Wipe  the outside of sample containers with a mild bleach solution if needed.
       D  Place  sample containers into a scalable plastic bag.
       D  Place  samples into an appropriate, rigid shipping container.
       D  Pack container with frozen ice packs.
       D  Complete "Sample Documentation Form" (Section 3.8).
       D  Complete "Chain of Custody Form" (Section 3.9).
       D  Secure shipping container with custody tape.
       D  Comply with any other sample security provisions required by participating agencies.

EXITING THE SITE
    Time of Site Exit: 	
    Site Exit Checklist
       D  Verify that hatches, locks, etc. are properly secured.
       D  Remove all samples, equipment, and materials from the site.
       D  Verify that all samples are in the cooler and properly seal the cooler.
       D  Remove all PPE at site perimeter.
       D  Place disposable PPE and other trash into a heavy-duty plastic trash bag.
       D  Verify that the perimeter has been properly secured before leaving the site.
       D  Ensure that all documentation has been completed before leaving the site perimeter.
       D  Comply with any site control measures required by participating agencies.
       D  Contact incident commander and inform them that the team is  leaving the site.
SIGNOFF
  Site Characterization Team Leader:
     Print name 	
     Signature  	   Date/Time:
                                        44                        Interim Final - August 2004

-------
Q
KH


O
O
OH
GO

W

Pi
              i
              O)
              c
             CO


6
Z
e
o
JS
o-







**
•*
^
«
H
2
.S
b-








«
E
Z
aj
?j
•PN
O3



bi
e
H
2
"«
E
o
V
•s
Q
vo
"08
1


l/^
^
3
^



wl-f.
c ^
'•S a
L^
pH




"a
Q
«
s^
u
o
s
1
H
a
^a
+J HH
V
§


,_!
e
0>
X.
u
"8
'—
-2
V
E
C3
08
o-

































































































































































































































































































































































































































































































































































































































































































































































































































































































































































-d
N
Kj
OJ
O
ft
•o
o
OJ
ts
•o
OJ
OJ
^
O
d
Q
S3
ts
• .3
.a> ll
•^ b a «-> —"
° M^ "^
.^•g 3 ^ ^ 'S
^S -o c§ g '^^
il gxgig"
S *'~l ^ Irt
3 u & " ^

'& o -5 ^ ^ a
«3 "S *^ & u
^ +•> *« S 1-1 «3
||li| e
jillli
llll.fl
U '^ 0 0 to °
1> 1> ?|~] ?|~] 1> g_>
TO* "3 o o Tl -i
g S 05 05 i^ g
3? o o o 3 "3
JJ ft ft ft 05 05
C/5 Pi Pi Pi Pi Pi
                                                                                                                                                o
                                                                                                                                                o
                                                                                                                                                
-------
Q
KH


O
o
OH
GO
W
Pi
              i
             £
              C
              O
              c
              o;
              o
              o
             Q
              Q>


              I
              
-^J
Oj
^
1
c/l
•5
"o
>~>
i
ed
"S
0>
1
c/l
ed
ffi
&

^
<4H
ed
^
rt
^
C/l
"S
W)
cj
&0
_g
^^
ed
'S
_O
S
c/l
_>
-J— >
oj
§
VH
-j— >
o
&
PH
^
                                                                                                                                                 o
                                                                                                                                                 o
                                                                                                                                                 
-------
3.9  Chain of Custody Form
Site Name:
Sampler Phone No.:
Sample ID




















Collection Date




















Relinquished by:
Relinquished by:
Relinquished by:
Relinquished by:
Relinquished by:
Sampler:
Signature:
No. Bottles




















Analysis




















Received by: Date/time:
Received by: Date/time:
Received by: Date/time:
Received by: Date/time:
Received by: Date/time:
Dispatched by: Date/time: Received for Laboratory by: Date/time:
Method of Sample Transport:
Shipper: Phone No.: Tracking No.:
                                     47
Interim Final - August 2004

-------
4  Sample Analysis
4.1  Laboratory Contact List
Analysis
Pathogens
Chemical
Chemical
Radiological
CW Agents
Laboratory





Physical Address





Contact Person





Phone





                                 48
Interim Final - August 2004

-------
4.2   General Approach for Analysis of Unknowns in Water
                 Review the Site
              Characterization Report
                Contaminant class
                nown or suspected''
  Perform Screening for
Chemicals ant/Biologicals
               Specific contaminant
               tentatively identified?
  Perform Screening for
 Chemicals or Biologicals
               Perform Confirmatory
                    Analysis
                   Presence of
                   contaminant
                   confirmed?
    Is additional
     screening
    necessary?
                      Revise/Expand
                    Analytical Approach
YES-
                Analysis Complete. \
                 Report Results.   f
                                          49
                         Interim Final - August 2004

-------
4.3  General Classes of Chemicals, Analyte Groups, and Example Contaminants
Chemical
types
Organic
Inorganic
Cyanides
Radionuclides
CW Agents
Analytical Group
Volatiles
Semivolatiles
Non- volatile s
Carbamate compounds
Quaternary nitrogen compounds
Pharmaceuticals
Trace metals
Nonmetals
Organometallics
Cyanides
Radiologicals
Schedule 1 only
Example Contaminants*
Acetone, acrylonitrile, chloroform, methyl ?-butyl ether,
tetrachloroethene, toluene,
Organophosphates (e.g., malathion, mevinphos, dichlorvos, etc.),
cyanazine, chlorinated insecticides, chlordane, pentachlorophenol
Sodium trifluroacetates, surfactants
Aldicarb, carbofuran, oxamyl
Diquat, paraquat
Nicotine, illicit drugs
Mercury, lead, cobalt
Arsenic salts
Organomercury compounds
Cyanide salts, cyanogen chloride
Cesium- 13 7, Cobalt-60, Strontium-92
(e.g., VX, sarin, nitrogen and sulfur mustards, Lewsites)
Not every contaminant in a particular analytical group is listed in this column.
4.4  General Classes of Pathogens, Specific Organisms, and Select Agent Status
Pathogen general class
Bacteria (non-spore forming)








Bacteria (spore forming)

Bacteria (Rickettsia)
Protozoa



Viruses







Organism
Brucella spp.
Burkholderia pseudomallerei
Campylobacter spp.
E. coli0157:H7
Francisella tularensis
Salmonella spp.
Shigella spp.
Vibrio cholerae
Yersinia pestis
Bacillus anthracis
Clostridium botulinum A
Coxiella burnetti
Cryptosporidium parvum
Entamoeba histolytica
Giardia intestinalis
Toxoplasma gondii
Enteroviruses
Hepatitis A
Hepatitis E
Noroviruses
Rotavirus
Variola
VEE
VHP
Select Agent*
Yes
Yes


Yes



Yes
Yes
Yes
Yes









Yes
Yes
Yes
* See http://www.cdc.gov/od/sap/docs/salist.pdf
                                   50
Interim Final - August 2004

-------
5   Response Actions

5.1   Decision Tree for Containment Options
                                  OR
Review existing information
                                       Determine whether
                                      the contaminated area
                                        can be estimated
                                       Estimate spread of
                                          contaminant
Threat
is 'possible'
                                       Determine whether
                                      the contaminated area
                                        can be contained
                                                                   Threat is
                                                                  'credible' or
                                                                  'confirmed'
              Determine whether
           the impacts of containment
                will be minimal
           Develop and implement a
             containment strategy
                          Develop and implement a
                           containment strategy
                                          51
                                 Interim Final - August 2004

-------
5.2   Decision Tree for Public Notification
                       Assess threat
                    credibility and public
                    health consequences
                Evaluate ability of operational
                 response actions to provide
              adequate public health protection
                        re operationa
                      response actions
                         adequate?
   YES-
     Public notification may
       not be necessary
                  Consult with appropriate
                  officials regarding public
                     notification options
                         Is boiling
                        effective and
                         dvisable?
                         Is there a
                      risk of dermal or
                        inhalational
                         exposure?
                                                        -NO-
YES—> Issue a "boil water" notice
 NO->
Issue a "do not drink" notice
                                                  Consider alternate water
                                                  supply for consumption
                 Issue a "do not use" notice t
                  Consider alternate water
                  supply for consumption,
                  sanitation, and other uses
                                          52
                          Interim Final - August 2004

-------
5.3   Contaminant Characterization and Transport Worksheet


INSTRUCTIONS
The purpose of this worksheet is to help organize information that will lead to the identification of the
contaminant to facilitate decisions on appropriate operational responses and provide more accurate
information for public communication/notification. Contaminant identification will most likely first be a
presumptive identification followed by more lengthy procedures to verify the identity of the contaminant.
While validated analytical results are typically the most reliable means of contaminant identification, other
information collected during the threat evaluation and site characterization may provide valuable
insight regarding the identity of the contaminant.

SITE CHARACTERIZATION/THREAT EVALUATION SUMMARY

Describe the contaminant's odor, if applicable.  	
Describe the reported taste of the contaminant, if applicable.	
Caution: Do NOT taste the water.

What was the physical form of the contaminant?
D  Solid                     D  Liquid                    D  Gas
D  Slurry                     D  Powder                  D  Granules
D  Other 	
What color was the contaminant?
Summarize additional information obtained during site characterization/threat warning that is relevant to
contaminant identification. 	
Summarize the on-line monitoring data, consumer complaints, or witness accounts that are relevant to
contaminant identification.
Field Analysis Summary

Summarize the results of the field analysis for the following parameters:

Radiation	
Chlorine residual	
pH, conductivity	
Cyanide	
Volatile chemicals _
Chemical weapons
Biotoxins	
Pathogens	
Other 	
                                          53                         Interim Final - August 2004

-------
Public Health Information

Have death or disease in the population been reported?         D  Yes    D  No     D  Unknown

Type/symptoms	
Is there information on unusual sales of pharmaceutical supplies (e.g., diarrhea medication)?	
Number of people affected      	
Number of fatalities            	
Location/area affected         	

Was an epidemiological investigation conducted?               D  Yes    D  No     D  Unknown
Results        	

Was a  clinical investigation conducted?                       D  Yes    D  No     D  Unknown
Results        	

Is the contaminant acutely toxic and what are the acute effects?  D  Yes    D  No     D  Unknown
Describe 	

LABORATORY ANALYSIS SUMMARY

Results of analysis	

Reporting units	
Analytical method
Minimum reporting level.
Precision (relative standard deviation).
QA/QC (e.g., recovery of matrix spikes, standard checks, etc.)
Summarize additional information obtained during laboratory analysis that is relevant to contaminant
identification.
                                          54                         Interim Final - August 2004

-------
CONTAMINANT CHARACTERISTICS
What is the class of the contaminant?
D  Biological                D  Chemical
D  Unknown 	
D  Radiological
Can any conclusions regarding the contaminant properties be made? (Place an 'X' in the appropriate
column)

Is the contaminant susceptible to
disinfection or chemical oxidation?
Does the contaminant hydrolyze into
less toxic products?
Does the contaminant hydrolyze into
more toxic products?
What are pKa values for chemicals?
Is the contaminant water soluble?
Does the contaminant have a
discernable taste, odor, or color?
Is the contaminant volatile or semi-
volatile?
Does the contaminant impact the pH?
Does the contaminant impact
conductivity?
Does the contaminant impact other
water quality parameters?
Does the contaminant react with
certain disinfectants (i.e., chlorine,
chloramines, etc.)?
What is the contaminant's half life?
Yes












No












Unk












Comment/Additional Information












Contaminant Public Health Effect Information

What are the primary routes of exposure?
D  Ingestion                 D  Inhalation
D  Unknown	
D  Dermal Contact
What are the acute health effects for the exposure routes identified?
What is the contaminant's LD5o/ID5o?
What is the length of time to first onset of symptoms after exposure?
What are the chronic health effects associated with exposure to the contaminant?
                                         55
           Interim Final - August 2004

-------
Does the contaminant have a method of secondary transmission?
D  Yes    D  No    D    Unknown
Describe                         	
Is an approach available to prevent undesirable health effects from the contaminant?
D   Yes    D  No    D    Unknown
Describe 	

Are there treatments available for individuals exposed to the contaminant?
D   Yes    D  No    D    Unknown
Describe 	

Are health standards for the contaminant available?
D   Yes    D  No    D    Unknown
Describe 	

By which exposure route(s)?
D   Ingestion          D    Inhalation
D   Dermal           D    Ocular

List the levels for each exposure route.
Contaminant Treatment Information
Treatment Types
Lime softening
Reverse osmosis
Standard chlorination
Enhanced
chlorination
Standard filtration
Enhanced filtration
Membrane filtration
Nanofiltration
Electrodialysis
Cation exchange
resin
Anion exchange resin
Activated alumina
Chloramine
Chlorine dioxide
Standard UV
Enhanced UV
Standard ozone
Enhanced ozone
Standard GAG
Enhanced GAG
Standard air stripping
Enhanced air
stripping
Other Methods
Could be used to
treat the
contaminant?





Yes
Yes
Yes
Yes




H Yes C
D Yes C
D Yes C
D Yes C
D Yes C
D Yes C
D Yes C
D Yes C
D Yes C
D Yes C











Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Yes









No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
No
Degradation products
formed as a consequence
of treatment























Rating of effectiveness
(poor, fair, good) of percent
effectiveness























                                          56
Interim Final - August 2004

-------
Access to contaminant information (effects and properties)

In-house information
Contact/phone no.   	
Internal database    	
Public Health officials
Contact/phone no.
Web site/database
US EPA Water Contaminant Information Tool
Web site/access code	
    •   US EPA water contaminant information tool (WCIT).
    •   US EPA's List of Drinking Water Contaminants & MCLs:
       http://www.epa.gov/safewater/mcl.htmltfmcls.
    •   Agency for Toxic Substances and Disease Registry (ATSDR): www.atsdr.cdc.gov.
    •   CDC Emergency Preparedness and Response: www.bt.cdc.gov.
    •   Recognizing Waterborne Disease and the Health Effects of Water Pollution: A Physician On-line
       Reference Guide: www.WaterHealthConnection.org.
    •   Physician Preparedness for Acts of Water Terrorism:
       www.waterhealthconnection.org/bt/index.asp.
    •   Registry of Toxic Effects of Chemical Substances (RTECS): www.cdc.gov/niosh/rtecs.html.
    •   Risk Assessment Information System (RAIS), which contains information taken from US EPA's
       Integrated Risk Information System (IRIS), the Health Effects Assessment Summary Tables
       (HEAST-rad HEAST-nonrad), US EPA Peer Reviewed Toxicity Values (PRTVs) Database, and
       other information sources:  http://risk.lsd.ornl.gov/index.shtml.
    •   United  States Army Medical Research Institute of Infectious Diseases (USAMRIID) Medical
       Management of Biological  Casualties Handbook:
       http://www.usamriid.armv.mil/education/bluebook.html.
    •   WHO: www.who.int/search/en/.
    •   WHO's "Public health response to biological and chemical weapons:"
       www.who.int/csr/delibepidemics/biochemguide/en/index.html.

CONTAMINANT TRANSPORT

Summarize what is known regarding the location of contaminant introduction.
How much material was used	[Ibs., tons, gal, etc.)

How was it added?           D  Single dose        D  Overtime    D    Unknown

Time period of suspected contaminant introduction. 	

Elapsed time. 	

Method of estimating the spread.
D  Manual calculations       D  Hydraulic model    D  Water flow analysis
D  CIS                     D  Field analysis      D  Areas of customer complaints
D  Areas of people with health-related symptoms
D  Other 	

Estimate the contaminated area. 	

Estimate the population affected.	
                                         57                         Interim Final - August 2004

-------
Identify any customers with special needs that are within the affected area.
D  Critical Care Facilities
    D  Hospitals                                    D  Clinics
    D  Nursing Homes                              D  Dialysis Centers
    D  Other 	
D  Schools
D  Day Care Facilities
D  Businesses
    D  Food and  Beverage Manufacturers            D  Commercial Ice Manufacturers
    D  Restaurants                                 D  Agricultural Operations
    D  Power Generation Facilities
    D  Other 	
SIGNOFF
    Name of person completing form
       Print name  	
       Signature  	    Date/Time:
                                           5 8                         Interim Final - August 2004

-------
5.4   Public Health Response Action Worksheet

INSTRUCTIONS
The purpose of this form is to help organize information to aid in the evaluation of containment options
and public notification options. The objectives of public health response actions (operational and public
notification) are to prevent or limit public exposure to potentially contaminated water by either restricting
further propagation of the contaminant through the distribution system or restricting use of the water
through public notification. This worksheet assumes that the "Contaminant Characterization and
Transport Worksheet" in Section 5.3 has been completed to the extent possible.

ASSESSMENT OF PUBLIC HEALTH IMPACT
Identity of the contaminant
Describe
                                D  Suspected     D  Known
     D  Unknown
Contaminant properties (if known):
       Toxic or infectious dose (LD5o/ID5o): 	
       Route of exposure:
       D  Ingestion              D  Inhalation
       D  Other
                                                 D  Dermal Contact
       Symptoms of exposure to high dose:
       Symptoms of exposure to low dose:
       Other:
EVALUATION OF CONTAINMENT OPTIONS

Describe the location and extent of the contaminated area.
Containment options
D  Valve closures
D  Isolate zone(s)
D  Other
                            D   Reverse flow conditions
D  By-pass
Critical equipment within contaminated area
D  System equipment        D  Zones
D  Hydrants                 D  Other	
                                                            D  Pump stations
Customers with special needs within contaminated area
D  Critical Care Facilities
    D  Hospitals
    D  Nursing Homes
    D  Other 	
    Schools
D
D
    Businesses
    D  Food and Beverage Manufacturers
    D  Restaurants
    D  Power Generation Facilities
    D  Other 	
                                                            D  Clinics
                                                            D  Dialysis Centers
                                                            D  Commercial Ice Manufacturers
                                                            D  Agricultural Operations
                                         59
                                                                   Interim Final - August 2004

-------
Effectiveness of containment options
D  Complete contaminant isolation                   D     Reduction in spread of contaminant
D  Unknown                                     D     Other	
Is containment expected to provide adequate public health protection?
D  Yes    D  No     D  Unknown

Timeline for implementation of containment options
Containment procedures to begin:      	
Containment procedures to end:       	
EVALUATION OF PUBLIC NOTIFICATION OPTIONS

Is public notification necessary?                                D       Yes     D      No

Collaboration Agencies (identified in Public Health Response Plan and Utility's ERP)
D   Public health agencies       D    Police departments        D  Fire departments
D   Hospitals/clinics             D    Laboratories              D  Drinking water primacy agency
D   Regional Poison Control Center
D   Other	

Type of notification (Follow steps shown)

Is the contaminant known?                                     D Yes  D No
         If no, issue a " Do Not Use" notice.
- If yes, is boiling effective and advisable?                        D Yes  D No  D Unknown
         If yes, issue  a "Boil Water" notice.
- - If no or unknown, is there a risk of dermal or inhalation exposure? D Yes  D No  D Unknown
         If no, issue a "Do Not Drink" notice.
         If yes or unknown, issue a " Do Not Use" notice.

Content of public notification
D   Has the contamination incident been confirmed?              D       Yes     D      No
D   Is the contaminant known?                                D       Yes     D      No
D   If yes, identity of the  contaminant 	
D   Characteristics of the contaminant 	
D   Restrictions on use 	
D   Ingestion exposure        D  Inhalation exposure           D  Dermal exposure
D   Exposure symptoms 	
D   Medical treatments 	
D   Transmission mode (if biological)  	
D   Duration of restriction 	
D   Alternate water supply 	
D Additional instructions to consumers
D Other information about the incident
D Other 	
                                         60                        Interim Final - August 2004

-------
Notification to customers with special needs
D  Critical Care Facilities
    D  Hospitals
    D  Nursing Homes
    D  Other  	
    Schools
                                                              D  Clinics
                                                              D  Dialysis Centers
D
D
    Businesses
    D  Food and Beverage Manufacturers
    D  Restaurants
    D  Power Generation Facilities
    D  Other                     	
                                                              D  Commercial Ice Manufacturers
                                                              D  Agricultural Operations
Are there subpopulations that will be affected at a greater rate than general population?
D  Yes    D  No     D   Unknown
Describe	

Notification to consecutive system.
D  Yes    D  No     D   Not Applicable
Method of dissemination
D     Broadcast media (radio and television)
D     Web site
D     Newspaper
D     Newsletters (water utility or partner organizations)
D     Broadcast phone messages
D     Posting in conspicuous locations
D     Hand delivery
D     Town hall meetings
D     Other                      	
                                                       D      Government access channels
                                                       D      Listserve email
                                                       D      Letters by mail
                                                       D      Phone banks
                                                       D      Broadcast faxes
                                                       D      Mass distribution through partners
                                                       D      Door-to-door canvassing
                                                       D      Conference calls
Notification/restriction timeline
Notification/restriction to begin: _
Notification/restriction to end:
ALTERNATE WATER SUPPLY NEEDS

Is an alternate water supply needed?
D     Drinking water          D     Fire fighting
D     Other          	
Where can customers obtain the alternate water supply?
D     Bottled water provided by local government agencies
D     Bottled water provided by local retailers
D     Bulk water provided by certified water haulers
D     Bulk water transported or provided by military assets
D     Bulk water providing by neighboring water utilities
D     Water treated at plant and hauled to distribution centers (i.e., in the case of distribution system
       contamination)
D     Other                     	
                                           61
                                                                      Interim Final - August 2004

-------
What customers with special needs should be notified of the alternate water supply availability?
D  Critical Care Facilities
    D  Hospitals                                               D  Clinics
    D  Nursing Homes                                         D  Dialysis Centers
    D  Other 	
D  Schools
D  Businesses
    D  Food and  Beverage Manufacturers                        D  Commercial Ice Manufacturers
    D  Restaurants                                            D  Agricultural Operations
    D  Power Generation Facilities
    D  Other                      	
SIGNOFF
    Name of person completing form
       Print name  	
       Signature  	   Date/Time:
                                           62                         Interim Final - August 2004

-------
6   Appendices




6.1  Critical System Information Checklist




          a  Population Served and Service Connections




          a  Distribution Network Map (including pressure zones)




          a  Pressure Zone Map




          a  Treatment Process Flow Diagram




          a  Chlorination Stations (location and quantity of chlorine on site)




          a  Chemical Handling and/or Storage Facilities and Release Impact Analysis




          a  Booster Pump Stations (location, capacity, and power requirements)




          a  Supervisory Control and Data Acquisition systems




          a  Site Staffing Rosters and Employee's Duties and Responsibilities




          a  Vulnerability Assessments




          a  Backup Equipment and Power Generation
                                      63                       Interim Final - August 2004

-------
6.2   Information Resources
   •   Agency for Toxic Substances and Disease Registry (ATSDR): www.atsdr.cdc.gov.
   •   AOAC. 2003b. "Rapid Test Kits Test Kit Database"
       http://www.aoac.org/testkits/TKDATA2.HTM.
   •   CDC Emergency Preparedness and Response: www.bt.cdc.gov.
   •   CDC. 2003f. "List of Select Biological Agents" http://www.cdc.gov/od/sap/docs/salist.pdf.
   •   CWC. 2003b. "The Chemical Weapons Convention - A Quick Guide, CWC-002"
       http://www.cwc.gov/lndustry Outreach/Publications/002/cwc-b0001  html.
   •   FEMA, Hazardous Materials Guide for First Responders. http://www.usfa.fema.gov/fire-
       service/hmgfr3.cfm
   •   Physician Preparedness for Acts of Water Terrorism:
       www.waterhealthconnection.org/bt/index.asp.
   •   Recognizing Waterborne Disease and the Health Effects of Water Pollution: A Physician On-line
       Reference Guide: www.waterhealthconnection.org.
   •   Registry of Toxic Effects of Chemical Substances (RTECS): www.cdc.gov/niosh/rtecs.html.
   •   Risk Assessment Information System (RAIS), which contains information taken from the US
       EPA Integrated Risk Information System (IRIS), the Health Effects Assessment Summary Tables
       (HEAST-rad HEAST-nonrad), US EPA Peer Reviewed Toxicity Values (PRTVs) Database, and
       other information sources:  http://risk.lsd.ornl.gov/index.shtml.
   •   US Army Medical Research Institute of Infectious Diseases (USAMRIID) Medical Management
       of Biological Casualties Handbook: http://www.usamriid.armv.mil/education/bluebook.html.
   •   US Army. 2002. "Toxic Chemical Agent Safety Standards"
       http://www.usapa.army.mil/pdffiles/p385 61.pdf.
   •   US Coast Guard. 2001. "Chemical Hazards Response Information System"
       http ://www. chrismanual. com.
   •   US EPA's List of Drinking Water Contaminants & Maximum Contaminant Levels (MCLs):
       http://www.epa.gov/safewater/mcl.htmltfmcls.
   •   US EPA. 2000. "EPA Radiological Emergency Response Plan"
       http://www.epa.gov/radiation/rert/docs/rerp-1 -OO.pdf.
   •   US EPA. 2003c. "EPA Environmental Technology Verification Home" http://www.epa.gov/etv/.
   •   US EPA. Undated c.  Compendium of Environmental Testing Laboratories.
       http ://www. epa. gov/compendium
   •   US National Library of Medicine. 2001. Toxicology Tutor I - Basic Principles. May 14.
       http://www.sis.nlm.nih.gov/ToxTutor/Toxl/al2.htm
   •   WaterlSAC, which contains information on contaminants including various contaminant fact
       sheets as well as the United Kingdom Water Industry Research (UKWIR) database:
       www.waterisac.org.
   •   WHO's "Public health response to biological and chemical weapons"
       www.who.int/csr/delibepidemics/biochemguide/en/index.html.
   •   WHO.  2001. "Health Aspects of Biological and Chemical Weapons"
       http://www.who.int/emc/Ddfs/BIOWEAPONS FULL TEXT2.pdf
                                         64                         Interim Final - August 2004

-------
6.3   Threat Management Matrices

This section presents a "contamination threat management matrix" for each of the threat
warnings described in Section 2.2.  Each matrix is a tabular summary that lists the following at
the 'possible,' 'credible,' and 'confirmatory' stages of the threat evaluation:
    •   Information considered during the threat evaluation.
    •   Factors considered during the threat evaluation.
    •   Potential response actions.
6.3.1  Security Breach
Information ^^H
Evaluation
Notifications
1 Response
THREAT EVALUATION STAGE
Possible
• Location of security breach.
• Time of security breach.
• Information from alarms.
• Observations when security
breach was discovered.
• Additional details from the
threat warning.
• Was there an opportunity for
contamination?
• Has normal operational
activity been ruled out?
• Have other "harmless"
causes been ruled out?
• Notifications within utility.
• Local law enforcement
agencies.
• Isolate affected area.
• Initiate site characterization.
• Estimate spread of suspected
contaminant.
• Consult external information
sources.
Credible
• Results of site characterization at
location of security breach.
• Previous security incidents.
• Real time water quality data from
the location of security breach.
• Input from local law enforcement.
• Do site characterization results
reveal signs of contamination?
• Is this security breach similar to
previous security incidents?
• Does other information (e.g.,
water quality) corroborate threat?
• Does law enforcement consider
this a credible threat?
• Drinking water primacy agency.
• State/local public health agency.
• FBI.
• Implement appropriate public
health protection measures.
• Plan for alternate water supply.
• Analyze samples.
• Perform site characterization at
additional investigation sites.
Confirmatory
• Results of sample analysis.
• Contaminant information.
• Results of site characterization
at other investigation sites.
• Input from primacy agency
and public health agency.
• Were unusual contaminants
detected during analysis? Do
they pose a risk to the public?
• Do site characterization results
reveal signs of contamination?
• Is contamination indicated by a
"preponderance of evidence?"
• Emergency response agencies.
• National Response Center.
• Other state and federal
assistance providers.
• Characterize affected area.
• Revise public health protection
measures as necessary.
• Provide alternate water supply.
• Plan remediation activities.
Security breaches may be the most common type of threat warning encountered by a utility since
they may result from trespassing, vandalism, theft, or failure to re-secure facilities following
legitimate activities.  The purpose of the threat evaluation under this scenario is to distinguish
between these more frequent, yet relatively harmless security breaches, and those few that might
be considered 'credible' contamination threats.

At the 'possible' stage of the threat evaluation, information about the security breach will be
available.  Specifically, the location of the security breach will be known, which will likely be
established as the initial investigation site. Other information may be available from alarms
                                        65
Interim Final - August 2004

-------
(including surveillance footage), which may help to establish the time of the security breach.
The evaluation at this stage should consider whether or not there was an opportunity for
contamination at the site of the security breach. Furthermore, "normal" activity should be
considered and investigated at this stage as a potential cause of the security breach (e.g., was a
utility crew recently at the site and potentially forgot to re-secure the area?). Potential response
actions to a 'possible' threat may include isolating areas of the system that could be affected,
initiating site characterization activities to collect more information in support of the threat
evaluation, and initiating the process to estimate the spread of the suspect water through the
system.

Information that may be available at the 'credible' stage includes the results of site
characterization, an assessment of previous security incidents, real-time water quality data in the
area of the security breach, and an assessment of the threat by law enforcement.  The evaluation
at this stage will consider whether or not signs of contamination were discovered during site
characterization, including unusual results from field testing or unusual observations during the
site investigation.  Consideration should also be given to whether or not the new information
available at this stage corroborates the information about the threat. If the threat is determined to
be 'credible,' response actions may include measures to limit or prevent exposure of the public to
the suspect water, such as public notification. Actions taken to  continue the investigation at this
point may include analysis of samples collected from the site, continued site characterization
activities, and an analysis to estimate the spread of the contaminant.

The new information available at the confirmatory stage may include the results  from laboratory
analysis, including QA/QC data to support the interpretation of the results.  If a specific
contaminant is identified, then additional information about that contaminant can be used to
further evaluate the nature of the threat as well as implications to public health.  The findings of
continued site characterization activities may also help to confirm the incident. The basis for
confirming a contamination incident can be analytical results that identify a specific contaminant
or other definitive evidence that a contaminant is present in the water.  If a contaminant has been
identified, consideration should be given to the health effects associated with exposure to that
contaminant. It may be necessary to revise the  sampling and analysis plans if a contaminant was
not positively identified through laboratory analysis but the threat is still deemed 'credible.'
Response actions potentially initiated once a contamination incident has been confirmed include
characterization of the contaminated area, revision to public health protection measures,
provision of alternate water supplies, and planning for remediation and recovery activities.
                                         66                        Interim Final - August 2004

-------
6.3.2  Witness Account
Information ^^H
Evaluation
Notifications
1 Response
THREAT EVALUATION STAGE
Possible
• Location of the suspicious
activity.
• Witness account of the
suspicious activity.
• Additional details from the
threat warning.
• Was there an opportunity for
contamination?
• Is the witness reliable?
• Has normal operational
activity been ruled out?
• Have other "harmless"
causes been ruled out?
• Notifications within utility.
• Local law enforcement.
• Isolate affected area.
• Initiate site characterization.
• Estimate spread of suspected
contaminant.
• Consult external information
sources.
• Interview witness for
additional information.
Credible
• Additional information from the
witness.
• Results of site characterization at
location of suspicious activity.
• Previous security incidents.
• Real time water quality data from
the location of suspicious activity.
• Input from local law enforcement.
• Do site characterization results
reveal signs of contamination?
• Is the suspicious activity similar
to previous security incidents?
• Does other information (e.g.,
water quality) corroborate threat?
• Does law enforcement consider
this a credible threat?
• Drinking water primacy agency.
• State/local public health agency.
• FBI.
• Implement appropriate public
health protection measures.
• Plan for alternate water supply.
• Analyze samples.
• Perform site characterization at
additional investigation sites.
Confirmatory
• Results of sample analysis.
• Contaminant information.
• Results of site characterization
at other investigation sites.
• Input from primacy agency
and public health agency.
• Were unusual contaminants
detected during analysis? Do
they pose a risk to the public?
• Do site characterization results
reveal signs of contamination?
• Is contamination indicated by a
"preponderance of evidence?"
• Emergency response agencies.
• National Response Center.
• Other state and federal
assistance providers.
• Characterize affected area.
• Revise public health protection
measures as necessary.
• Provide alternate water supply.
• Plan remediation activities.
From the perspective of the threat management process, a threat triggered by a witness account is
similar to one triggered by a security breach. One of the few significant differences is the use of
information collected directly from the witness throughout the evaluation, particularly during the
'possible' and 'credible' stages of the threat evaluation. The reliability of the witness must be
considered when making these determinations, and additional evidence collected during the
investigation should be evaluated to determine whether or not it corroborates the witness
account.
                                         67
Interim Final - August 2004

-------
6.3.3  Direct Notification  by Perpetrator
 08
 I
 ,o
                                  THREAT EVALUATION STAGE
               Possible
   Transcript of phone (or
   written) threat.
   The who, what, where,
   when, and why of the threat.
   Additional details from the
   threat warning.
   Vulnerability assessment.
                                         Credible
   Law enforcement assessment.
   Primacy agency assessment.
   Previous threats at this utility or
   other utilities.
   Results of site characterization at
   selected investigation sites.
   Real time water quality data.
   Reports from ISAC, EPA, etc.
                                          Confirmatory
   FBI assessment.
   Results of sample analysis.
   Contaminant information.
   Results of site characterization
   at other investigation sites.
   Input from primacy agency
   and public health agency.
 e
 js
 -^
 es
 "es
   Is the threat feasible?
   Has the water already been
   contaminated?
   Is the location known or
   suspected?
   Is the identity of the
   perpetrator known or
   suspected?
   Have there been personnel
   problems at the utility?
   Do site characterization results
   reveal signs of contamination?
   Does other information (e.g.,
   water quality) corroborate threat?
   Does law enforcement consider
   this a credible threat?
   Does the primacy agency consider
   this a credible threat?
   Were unusual contaminants
   detected during analysis? Do
   they pose a risk to the public?
   Do site characterization results
   reveal signs of contamination?
   Is contamination indicated by a
   "preponderance of evidence?"
 e
 o
 •-B
 es
•  Notifications within utility.
•  Local law enforcement.
•  Drinking water primacy
   agency.
                                      FBI.
•  State/local public health agency.
•  EPA Criminal Investigation
                                      Division.
•  Emergency response agencies.
•  National Response Center.
•  Other state and federal
   assistance providers.
 e
 o
 a
   Isolate affected area if
   identified in the threat.
   Identify sites and initiate site
   characterization.
   Consult external information
   sources.
   Gather information from law
   enforcement assessment.
   Implement appropriate public
   health protection measures.
   Plan for alternate water supply.
   Analyze samples.
   Perform site characterization at
   additional investigation sites.
   Estimate spread of suspected
   contaminant.
   Characterize affected area.
   Revise public health protection
   measures as necessary.
   Provide alternate water supply.
   Plan remediation activities.
Threats to contaminate the water made via direct notification by a perpetrator need to be taken
seriously. However, the majority of such direct threats are hoaxes that may be intended to cause
panic or disruption, gain attention, or fulfill a personal vendetta.  Thus, the focus of the threat
evaluation for this type of threat warning is to identify any credible threats amongst the larger
number of hoax notifications.  In any case, direct threats against the water supply should be
reported to local law enforcement.

A key source of information that may support the threat evaluation under this scenario is
provided directly by the perpetrator making the threat.  In the case of a phone threat, it is
important to collect information about the threat from the  caller to support the threat evaluation.
Similarly, a written notification should be carefully reviewed for details about the threat.
Additional information collected throughout the investigation should be evaluated against the
details  of the threat notification, and it corroborates the details of the notification, then the threat
is more likely to be deemed 'credible.'
                                                                         Interim Final - August 2004

-------
One of the potential challenges in managing a threat triggered by direct notification from a
perpetrator is identification of an investigation site that will be the focus of site characterization
activities.  Unless a location is named in the threat, it will be necessary to use other information,
such as that derived from vulnerability assessments or unusual water quality data/consumer
complaints, to identify investigation sites.
                                          69                         Interim Final - August 2004

-------
6.3.4   Unusual Water Quality or Consumer Complaints
Unusual Water Quality
Information ^^H
Evaluation
Notifications
1 Response
THREAT EVALUATION STAGE
Possible
• Unusual water quality data.
• Baseline water quality data.
• Real time water quality data.
• Operational information
corresponding to the time of
the unusual water quality.
• Is the unusual water quality
significantly different from
an established baseline?
• Could operational changes
be the cause?
• Could changes in source
water quality be the cause?
• Are there similar results at
other monitoring locations?
• Notifications within utility.
• Identify sites and initiate site
characterization.
• Begin analysis of available
water quality data.
• Investigate unusual
consumer complaints.
• Consult external information
sources.
Credible
• Results of site characterization at
selected investigation sites.
• Previous threat warnings triggered
by water quality.
• Contaminant information.
• Reports of consumer complaints.
• Do site characterization results
reveal signs of contamination?
• Is this unusual data substantial
different from other water quality
episodes?
• Is the unusual data indicative of a
specific contaminant?
• Are the unusual water quality
clustered in a specific area?
• Are there any unusual consumer
complaints in the area?
• Drinking water primacy agency.
• State/local public health agency.
• Local law enforcement.
• FBI.
• Estimate affected area and isolate
if possible.
• Implement appropriate public
health protection measures.
• Plan for alternate water supply.
• Analyze samples.
• Perform site characterization at
additional investigation sites.
Confirmatory
• Results of sample analysis.
• Contaminant information.
• Results of site characterization
at other investigation sites.
• Input from primacy agency
and public health agency.
• Were unusual contaminants
detected during analysis? Do
they pose a risk to the public?
• Do site characterization results
reveal signs of contamination?
• Is contamination indicated by a
"preponderance of evidence?"
• Emergency response agencies.
• National Response Center.
• Other state and federal
assistance providers.
• Characterize affected area.
• Revise public health protection
measures as necessary.
• Provide alternate water supply.
• Plan remediation activities.
Consumer Complaint
 08
 I
 ,o
                                 THREAT EVALUATION STAGE
               Possible
Compilation of consumer
complaints, including
geographic distribution.
Recent water quality data
that may be associated with
complaints.
Operational information
corresponding to the time of
the unusual complaints.	
                                     Credible
Results of site characterization at
selected investigation sites.
Summary of historic consumer
complaints.
Results of consumer interviews.
Contaminant information.
                                      Confirmatory
Results of sample analysis.
Contaminant information.
Results of site characterization
at other investigation sites.
Input from primacy agency
and public health agency.
                                            70
                                                               Interim Final - August 2004

-------
 e
 js
 -^
 es
 3
 "es
Are the complaints unusual?
Could operational changes
be the cause?
Could changes in source
water quality be the cause?
Are the complaints clustered
in a specific area?
Are complaints from
habitual complainers?
Do site characterization results
reveal signs of contamination?
Are other consumers in the area
experiencing similar water
quality?
Are the unusual complaints
significantly different from typical
complaints?
Are the complaints indicative of a
specific contaminant?
Is there anything unusual about
the water quality in the area?	
Were unusual contaminants
detected during analysis? Do
they pose a risk to the public?
Do site characterization results
reveal signs of contamination?
Is contamination indicated by a
"preponderance of evidence?"
 JS
 -fcj
 08
 O
 S
 -fcj
 o
        Notifications within utility.
                          •  Drinking water primacy agency.
                          •  State/local public health agency.
                          •  Local law enforcement agency.
                          •  FBI.
                               •  Emergency response agencies.
                               •  National Response Center.
                               •  Other state and federal
                                  assistance providers.
 •J-.
 e
 o
 a
 •J-.
Identify sites and initiate site
characterization.
Begin analysis of available
water quality data.
Interview consumers in area
with high numbers of
complaints.
Consult external information
sources.
Estimate affected area and isolate
if possible.
Implement appropriate public
health protection measures.
Plan for alternate water supply.
Analyze samples.
Perform site characterization at
additional investigation sites.
Characterize affected area.
Revise public health protection
measures as necessary.
Provide alternate water supply.
Plan remediation activities.
A threat warning arising from unusual water quality data is significantly different from the
other threat warnings previously discussed and thus should be handled differently during the
threat evaluation.  In determining whether or not the threat is  'possible,' it is necessary to
evaluate the anomalous data relative to an established baseline. Furthermore, it is important to
consider operational conditions, or potential impacts from changing source water quality or
distribution system blending as possible  explanations for the unusual water quality or complaint.
If the unusual water quality data is determined to be significantly different from the baseline, and
cannot be explained by other factors, then t contamination may be considered a possibility.

Presumably, the unusual water quality data will be associated with a particular location in the
system, which will help in the identification of investigation sites that will be the focus of site
characterization activities. At this stage, it is important to verify the anomalous water quality
data through additional testing using independent equipment.  For example, if an incident was
triggered by a rapid decrease in the free chlorine residual, as detected by online electrochemical
monitors, additional testing could be performed with colormetric field kits to confirm the results.
Additional rapid field testing might also  help to determine the bounds of the affected area.
Furthermore, specific information about particular contaminants should be considered at the
'credible' stage as it might be used to identify potential contaminants that would impact the
water quality parameter with anomalous readings.  For example, contaminants with acidic
functional groups might result in reduced pH.
                                            71
                                                               Interim Final - August 2004

-------
6.3.5   Notification by Public Health
Information ^^H
Evaluation
Notifications
1 Response
THREAT EVALUATION STAGE
Possible
• Details of notification from
public health sector.
• Symptoms of disease and
causative agent, if known.
• Contaminant information.
• Why is water under
investigation as a possible
source?
• Are the reported symptoms
consistent with exposure to
the contaminant via water?
• If causative agent is known,
is it stable in water?
• Notifications within utility.
• State/local public health
agency.
• Drinking water primacy
agency.
• Consult with public health
agency and primacy agency.
• Consult external information
sources.
Credible
• Geographic distribution of disease
or death.
• Recent water quality and
operational data.
• Reports of consumer complaints.
• Contaminant information.
• Is the geographic pattern of
exposure consistent with exposure
to contaminated water?
• Is there a recent occurrence of
unusual water quality data or
consumer complaints?
• Does additional information about
the potential contaminant indicate
water as a potential source?
• FBI.
• Local and State law enforcement
agencies.
• Estimate affected area and isolate
if possible.
• Implement appropriate public
health protection measures.
• Plan for alternate water supply.
• Identify sites and initiate site
characterization.
• Analyze samples.
Confirmatory
• Results of site characterization
at selected investigation sites.
• Results of sample analysis.
• Contaminant information.
• FBI assessment.
• Has the public health agency
concluded that water is the
cause of the disease or deaths?
• Did sample analysis detect the
causative agent?
• Was another contaminant
detected during sample
analysis that could be the cause
of the disease or deaths?
• Emergency response agencies.
• National Response Center.
• Other state and federal
assistance providers.
• Characterize affected area.
• Revise public health protection
measures as necessary.
• Provide alternate water supply.
• Plan remediation activities.
Notification from public health officials regarding a potential water contamination incident is
unique in that individuals have been exposed to a harmful substance resulting in illness, disease
or death in the population. The threat evaluation in this case may be part of a larger
epidemiological investigation to determine the cause of disease. It is critical that the utility work
with the appropriate public health officials from the outset, since these officials will likely have
information critical for the evaluation.  For example, they may know or suspect the causative
agent based on clinical information. This knowledge, in conjunction with information about the
properties of the contaminant, may indicate whether or not contaminated water is even a
possibility.  For example, if the causative agent is known to immediately break down into
harmless byproducts upon exposure to water, then the possibility of contaminated water might be
dismissed.

If water is considered a possible carrier for the contaminant, then further investigation should be
conducted to determine if water is the most likely carrier of the contaminant (i.e., analogous to
the 'credible' stage of the threat evaluation). Information that may help to make this
determination will include additional findings from the larger epidemiological investigation,
geographic distribution of exposure, recent water quality and operational data, and reports of
                                         72
Interim Final - August 2004

-------
consumer complaints. If this additional information indicates that water contamination is likely,
response actions would likely include public notification and sampling for the contaminant. The
sampling plan developed at this point may start with information about the geographic
distribution of exposure; however, consideration must be given to the latency period of the
disease, which could be from minutes to weeks, as well as the travel time within the system. The
objectives of sampling and analysis at this point would include: 1) confirming the presence of the
contaminant in the water; 2) determining if the contaminant is still present; and 3) determining
the area affected.  If water contamination is confirmed, and the contaminant is still present in the
system, it will be necessary to begin planning for remediation and recovery efforts. If the
contaminant is not found, extensive sampling would likely be necessary to demonstrate that the
contaminant is indeed absent from the system.
Office of Ground Water and Drinking Water
Water Security Division
EPA817-D-04-001
www. epa. gov/safewater/security
August 2004
                                        73                        Interim Final - August 2004

-------
Office of Ground Water and Drinking Water
Water Security Division
EPA817-D-04-001
www.epa.gov/safewater/security
August 2004                                          Printed on Recycled Paper

-------